Field keyword

Elastic Stack Logstash
1

Hello,

My problem is that if I want to filter my field "ID appel.keyword" in kibana with the value
SD6hb3401-55be9241cf7883a8d769e2f16c2747e2-v300g00 kibana show me two results. The problem is that the two results are exactly the same as you can see on the screenshot (There are no speaces at the beginning and at the end I already checked).

Capture

If I choose one kibana show me some lines with this ID and if I choose the other it show me others lines with this ID. It look like these IDs are not the same in kibana's point of view.

I think this is because in my logstash config some "ID appel" are extrated directly from the log file with a csv filter and some others are made by contatenating field.

The main problem is not that kiabana can't filter properly but it's that I can't use the aggregate filter in my logstash with the task_id "ID appel". In fact if I try to use the aggregate filter it react like if the ID are not the same (like kibana).

I hope it was clear.

2

The problem is solved, the "ID appel" that I made by concatenating fields was composed with a return at the end (\r) and that is not visible in kibana.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.