My current logstash indexing is not working in 7.0 is it the syntax in 7.0 are changed?
btw, all this while, it is working in 6.7
My current configuration as below,
input {
tcp {
port => 5514
type => syslog
}
udp {
port => 5514
type => syslog
}
}
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}
output {
elasticsearch { hosts => ["10.3.3.41:9200"] }
stdout { codec => rubydebug }
}
i can see my input from /var/log/messages,
May 8 15:37:03 z3elk-01 logstash: {
May 8 15:37:03 z3elk-01 logstash: "type" => "syslog",
May 8 15:37:03 z3elk-01 logstash: "@version" => "1",
May 8 15:37:03 z3elk-01 logstash: "@timestamp" => 2019-05-08T07:37:10.000Z,
May 8 15:37:03 z3elk-01 logstash: "syslog_hostname" => "z3leo-r03",
May 8 15:37:03 z3elk-01 logstash: "message" => "<166>May 8 15:37:10 z3leo-r03 IgmpSnooping: %IGMPSNOOPING-6-NO_IGMP_QUERIER: No IGMP querier detected in VLAN 7. IGMP report received from 30.32.7.61 on Ethernet11 for 239.255.255.253",
May 8 15:37:03 z3elk-01 logstash: "syslog_timestamp" => "May 8 15:37:10",
May 8 15:37:03 z3elk-01 logstash: "received_at" => "2019-05-08T07:37:02.972Z",
May 8 15:37:03 z3elk-01 logstash: "host" => "10.3.3.225",
May 8 15:37:03 z3elk-01 logstash: "received_from" => "10.3.3.225",
May 8 15:37:03 z3elk-01 logstash: "syslog_message" => "%IGMPSNOOPING-6-NO_IGMP_QUERIER: No IGMP querier detected in VLAN 7. IGMP report received from 30.32.7.61 on Ethernet11 for 239.255.255.253",
May 8 15:37:03 z3elk-01 logstash: "syslog_program" => "IgmpSnooping"
May 8 15:37:03 z3elk-01 logstash: }
but it cannot be index and display in kibana console, any expert can advice?