I am trying to add a new custom field from the message but new field do not show up in Kabana. There is no error in logstash logs.
Below is my logstash code
if [fields][app_name] == "cobra" {
if [source] =~ /^".*(\|/)(CobraLogsArchive_Dev).csv"$/ {
csv {
separator => ","
columns => [ "AtWhen","ByWho","What","Params","Appname","ID"]
}
grok {
match => { "message" => "%{GREEDYDATA:AtWhen},%{GREEDYDATA:ByWho},%{GREEDYDATA:What},%{GREEDYDATA:Params},%{GREEDYDATA:ApplicationName},%{GREEDYDATA:IDnumber}" }
overwrite => ["message"]
add_tag => ["cobracustomlogs"]
}
date {
match => ["AtWhen","YYY-MM-dd HH:mm:ss:SSS"]
target => "AtWhen"
}
mutate { convert => ["ID", "integer"] }
mutate { add_field => {"application_name" => "%{ApplicationName}"} }
}
}