Elasticsearch Unknown Field, logEvents

Elastic Stack Elasticsearch
1

Hi there,

I'm using ELK 7.6. I am ingesting logs from S3 buckets via SQS. These S3 logs are piped using Firehose from Cloudwatch logs.

I have encountered Unknown Field, logEvents, in my indices.

image

What it contains inside is this:

2
21353×563 26.3 KB

There is no fix number of message fields inside each logEvents field.
How do I pattern this index such that I can search for the logs inside the message field?
Pls guide me patiently as I'm new at this. :grin:

Thanks,
ck

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.