HI Magnus,
it was there for a long time, hardly i have 5 lines in the csv file, here is the console output
bin/logstash -f MBXLogstash20170709.conf
ERROR StatusLogger No log4j2 configuration file found. Using default configuration: logging only errors to the console.
Sending Logstash's logs to /apps/mft/ELK/logstash/logs which is now configured via log4j2.properties
[2017-08-09T07:55:00,084][INFO ][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://192.168.56.105:9200/]}}
[2017-08-09T07:55:00,098][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://192.168.56.105:9200/, :path=>"/"}
[2017-08-09T07:55:00,245][WARN ][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=>#Java::JavaNet::URI:0x14200553}
[2017-08-09T07:55:00,247][INFO ][logstash.outputs.elasticsearch] Using mapping template from {:path=>nil}
[2017-08-09T07:55:00,314][INFO ][logstash.outputs.elasticsearch] Attempting to install template {:manage_template=>{"template"=>"logstash-", "version"=>50001, "settings"=>{"index.refresh_interval"=>"5s"}, "mappings"=>{"default"=>{"_all"=>{"enabled"=>true, "norms"=>false}, "dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date", "include_in_all"=>false}, "@version"=>{"type"=>"keyword", "include_in_all"=>false}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}}
[2017-08-09T07:55:00,332][INFO ][logstash.outputs.elasticsearch] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>[#Java::JavaNet::URI:0x1b4a3154]}
[2017-08-09T07:55:00,392][INFO ][logstash.pipeline ] Starting pipeline {"id"=>"main", "pipeline.workers"=>2, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>250}
[2017-08-09T07:55:00,581][INFO ][logstash.pipeline ] Pipeline main started
[2017-08-09T07:55:00,653][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
Here is the complete logstash config
$ cat MBXLogstash20170709.conf
input {
file {
path => "/apps/mft/ELK/MBXLogFiles/test.log"
start_position => "beginning"
}
}
filter {
csv {
separator => ","
columns => ["Destination","MailboxName","BPId","MessageId","FileName","Bytes","Date","Time","Action"]
}
mutate {
convert => { "Bytes" => "integer" }
}
grok {
match => ["MailboxName", "^/(?[^/]+)/"]
}
}
output {
stdout { codec => rubydebug }
elasticsearch {
hosts => ["192.168.56.105:9200"]
index => "mbx201707log"
document_type => "mbx201707doctype"
}
}