Filebeat - Module Elasticsearch - Parsing date

I am using Filebeat Elasticsearch Module, but timestamp is not parsed from elasticsearch logs. Can Filebeat Elasticsearch Module parse timestamp from elasticsearch logs? From some reason I see all collected documents in index with the same timestamp.

I am using Elasticstack components of version 7.0.1.

Can you share the following information:

  1. your modules.d/elasticsearch.yml
  2. some sample lines from the Elasticsearch log that are not being parsed correctly
  3. a document from the index corresponding to one of the sample lines from above, showing the badly-parsed timestamp
  4. Elasticsearch generates mutiple log files — please tell us if this is the server log, deprecation log, or some other log.



This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.