Formatted values in logstash are not displayed

Formatted values in logstash are not displayed.

  • want to
    I would like to split the log collected by logstash and get it by dissect, and check each in a different field in Kibana.

  • issue
    However, the variable name on the logstash is displayed instead of the retrieved value.
    How can I display the retrieved value?

  • experiment
    input:

    A	B
    

    settings:

    ... snip ...
    filter {
      dissect {
        mapping => {
          "message" => "%{ia}	%{ib}"
        }
      }
      mutate {
        add_field => { "a" => "%{ia}" }
        add_field => { "b" => "%{ib}" }
      }
    }
    

    expect:

    "a" => "A",
    "b" => "B"
    

    actual:

    "a" => "%{ia}",
    "b" => "%{ib}"
    

In Kibana, it looks like this

Was it the logstash category, not Kibana?
I apologize for that.
I hope someone can answer my question.

The problem is solved in this thread, and I'll write down the URL.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.