Hi, the api and index fields are not being populated in the request logs. for this i am using the custom pattern grok rules to extract the index and api values from the uri field like below. some how it doesn't works for me. any suggestions/help would be appreciated.

How to extract index name from the uri field in logstash

magnusbaeck (Magnus Bäck) June 13, 2018, 9:07am 11

I would expect you to know what kind of data enters Logstash. If it's JSON data that you're parsing with the json filter you obviously need to put the json filter before any filters that want to process fields found in the JSON string.

Topic		Replies	Views
Indexing custom fields from grok filter Logstash	6	4103	July 6, 2017
GROK Failure Logstash	30	4263	December 13, 2017
Not able to index the logs coming from Shipper through redis into the ELK Logstash	12	1182	July 6, 2017
Extracting fields and then indexing JSON in a log Logstash	2	1420	July 6, 2017
Split grok pattern Logstash	3	2937	July 6, 2017

How to extract index name from the uri field in logstash

Related topics