I am trying to configure SpringBoot <> FileBeat <> LogStash <> ElasticSearch <> Kibana.
But I am getting error at LogStash, here is my code snippets:
filebeat.yml:
filebeat:
inputs:
- type: log
paths:
- /Users/Smit/Downloads/chrome/observability/spring_app_log_file.log
output:
logstash:
hosts: ["localhost:5044"]
logstash.config:
input {
beats {
port => "5044"
}
}
filter {
#If log line contains tab character followed by 'at' then we will tag that entry as stacktrace
if [message] =~ "\tat" {
grok {
match => ["message", "^(\tat)"]
add_tag => ["stacktrace"]
}
}
}
output {
stdout {
codec => rubydebug
}
# Sending properly parsed log events to elasticsearch
elasticsearch {
hosts => ["localhost:9200"]
}
}
Error Related in info:
Log:
{
"@version" => "1",
"ecs" => {
"version" => "1.5.0"
},
"agent" => {
"hostname" => "Smits-MacBook-Pro.local",
"type" => "filebeat",
"ephemeral_id" => "76f5b858-bc2d-4f13-bdb1-98f4cad7ce28",
"version" => "7.8.0",
"id" => "864be1a9-e233-4d41-8624-cf94e916a0b7",
"name" => "Smits-MacBook-Pro.local"
},
"@timestamp" => 2020-06-27T17:30:53.807Z,
"tags" => [
[0] "beats_input_codec_plain_applied"
],
"log" => {
"offset" => 8939,
"file" => {
"path" => "/Users/Smit/Downloads/chrome/observability/spring_app_log_file.log"
}
},
"input" => {
"type" => "log"
},
"message" => "2020-06-28 01:30:50.017 INFO 41266 --- [http-nio-8080-exec-6] c.e.observability.aop.LoggingAdvice : Method Invoked getGreeting in class class com.example.observability.service.GreetingService with args [godknows]",
"host" => {
"name" => "Smits-MacBook-Pro.local"
}
}
Error:
[2020-06-28T01:30:54,983][WARN ][logstash.outputs.elasticsearch][main][e355ceb00d3e298d5bee1962185a3aac2c9bdd4e945037e76fdcce0f773027e6] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0x2103d045>], :response=>{"index"=>{"_index"=>"logstash-2020.06.27-000001", "_type"=>"_doc", "_id"=>"znzV9nIBBsHFC7FTBLmF", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [host] of type [text] in document with id 'znzV9nIBBsHFC7FTBLmF'. Preview of field's value: '{name=Smits-MacBook-Pro.local}'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:708"}}}}}