Apply grok pattern based on the log file path

Elastic Stack Logstash
42

Normally the date field should always have: date, time in ms set to UTC. For instance: 2023-06-15T16:44:01.123Z. It's not easy to understand why you have separate date and time. Most likely

Please do next for a single index which you prefer:

  1. Add rubydebug to see how data looks like before ends in ES.
output {
    stdout { codec => rubydebug{} }
  elasticsearch { ...
  }
}
  1. Copy the final grok version for index where data are not parse.
  2. Run LS and copy how data looks originally and parsed in fields where data are not parse.

PS. Sorry for delay.

43

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.