Hi, we have moved to elastic from our on prem 6.2 version elk cluster. We are currently having some problems into decoding json docker logs and renaming indices. My filebeat.yml test file is as follows:
before we were going though logstash and renaming the indices were quite easy and flexible. Had to include json.ignore_decoding_error: true to cut off those decoding error messages. Can someone please advise?
Please format logs and configs using the </> button.
There should be no decoding error if the log is using JSON. Have you checked the log files with decoding errors, if they are JSON for real? Do these have very very long lines by any chance?
You'd need to add the json.ignore_decoding_error: true to the input configuration block. It has no effect at the place you put it in.
Doing some testings with json only log files and it works, i believe the error was due to other formats of logs, however, still cannot change the index names, its always sending data to filebeat-7.2. Any suggestions?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.