Elastic Stack: Logging Lab 4 - The second problem

Elastic Community and Ecosystem Elastic Training
1

Hi,

I just finished Elastic Stack: Logging Lab 4. However, when I looked at data in Kibana, what I got is different from what is in the tutorial pdf.

The following is the screenshot from my Kibana:

6666
6666.png691×863 105 KB

The lines I got below confuse me, which are different from what I should got based off of the Lab 4 pdf.
"tags": [
"beats_input_codec_plain_applied",
"_grokparsefailure",
"_geoip_lookup_failure"
]

Hope someone can help me here! Thank you!

2

Just like your other thread, is this related to the online training?

3

Yes, it is too.

4

Hello,

It looks like at some point you ingested data with Logstash that Logstash could not parse. It therefore generated a _grokparsefailure. You would want to remove that data from your index.

You might try deleting that index and reloading the data with Logstash. Make sure you didn't change any of the configs for Logstash.

I recommend out "Elastic Stack Data Administration" (taught in-person and in our virtual classroom) course to get a better idea of how Logstash works as well as Beats. Ingesting data with these tools allows you to use Machine Learning to detect when anomalous behaving is occurring.

5

Hi Nathan,

Thank you for your answer. It is very helpful!

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.