How to make an index as the destination index to store the data


#1

I am using elasticsearch and kibana for displaying the logs. When i use logstash-* index the logs are disapying in kibana but when i am using the index which i created is not displaying any data.
Is there any option to make the new index as the destination index to store data in elasticsearch.
i can copy data using reindex and new index is showing the copied data but not receiving any new data.

[]# curl -XGE http://localhost:9200/_cat/indices?v
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
yellow open logstash-2017.09.08 cS_z3ruvRb2lFk8Z-y_nww 5 1 116 0 128.1kb 128.1kb
close issuepredtool 3mcGPLT7RKSeHslHlPua5w
yellow open fluentd juxdqw3QRNmH0NyMp9ZNTw 5 1 108 0 100.3kb 100.3kb
yellow open .kibana Z_EGBqWFSn6wtdhc0mYDsg 1 1 4 0 18.3kb 18.3kb
yellow open test 4DzRjVhhT8KoGTuOrkpSYA 5 1 1 4 4.6kb 4.6kb
yellow open issuepredtool1 U4L2epxHTs-Ke8yLkF-OBQ 5 1 114 0 71.9kb 71.9kb


issuepredtool1 index which i created and for testing purpose i have copied the data from logstash-* index using reindex and kibana displaying this data.

curl -XGE http://localhost:9200/issuepredtool1
{"issuepredtool1":{"aliases":{"fazi":{}},"mappings":{"fluentd":{"properties":{"@timestamp":{"type":"date"},"arguments":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"issue":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"issue_category":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"log_id":{"type":"long"},"server_name":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"time_stamp":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}}}}},"settings":{"index":{"creation_date":"1504880653564","number_of_shards":"5","number_of_replicas":"1","uuid":"U4L2epxHTs-Ke8yLkF-OBQ","version":{"created":"5050299"},"provided_name":"issuepredtool1"}}}}

Please help to set the newly created index to receive data.
Kibana and elasticsearch version 5.x


(Christoph) #2

It looks like you are using logstash to ingest your data (that seems to be working). I have little experience in how to configure the logstash output, but I'm pretty sure this is the first place to look to change the index name your data gets send to. Sorry if I'm stating something obvious.


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.