5.6 fundamentally broken

[Sjaak01 (Sjaak)]

I don't know if this is logstash or elastic but 5.6 and 5.4 to some extent are fundamentally broken.

On 5.4 I can't get the KV filter to create any mapping. Opened a topic but no solution.

KV field_split prevents logstash ingesting data

The fields in the mapping only matches some of your fields. If you enable the kv parsing and alter the elasticsearch output to write to a new index, does any data get inserted then? If so, what does the mappings look like? You could also try to write records to a file using a json_lines codec. This would allow you to inspect the data and see if there are any fields that are generated and might cause a mapping conflict.

On 5.6 the netflow codec and KV filter are both broken. Logstash and Elastic are running without errors but no data is sent to Elastic.

5.6.1 Netflow not working

Hi, I've updated from 5.4 to 5.6.1 so I could use the latest netflow codec with support for Fortigate devices but now I got no netflow data coming in anymore. I did not change the config and logstash log shows no errors. config input { udp { port => 9995 type => "netflow" codec => netflow { } } } filter { mutate { add_field => { "[netflow][ipv4_dst_host]" => "%{[netflow][ipv4_dst_addr]}" "[netflow][ipv4_src_host]" => "%{[netflow][ipv4_src_addr]}" } } if…

This is not a problem with my configs, on 5.4 netflow works and stdout shows no problems with the KV filter. On 5.6.1 and 5.6.2 nothing works, its totally dead. No changes to the system or the configs.

I'm running Ubuntu 16.04 inside virtualbox.

Everything appears to be running, no errors anywhere but for whatever reason no data shows up. I have no clue how to proceed and am about to give up on this.