If the kibana is storing the dashboard in ES .kibana index then how can i save the dashboard so that users after spinning up the ELK using docker-compsoe can access the dashboard? I know volume is used for persistent storage, but I am talking about scenario in which this docker compose setup should be run on different setups in which storing dashboard on volume would not be an option.
[root@onw-kwah-2v logstash]# cat pipeline/bp-filter.conf
input {
file {
path => "${INPUT1}/syslog.log*"
start_position => "beginning"
sincedb_path => "/dev/null"
}
}
filter {
grok {
match => {"message" => ["%{TIMESTAMP_ISO8601:logdate} %{HOSTNAME:hostname} %{WORD:conatiner_name}: %{GREEDYDATA:[@metadata][messageline]}",
"%{TIMESTAMP_ISO8601:logdate} %{HOSTNAME:hostname} %{WORD:container}\[%{INT:haprorxy_id}\]: %{GREEDYDATA:[@metadata][messageline]}"]}
}
if "_grokparsefailure" in [tags] {
drop {}
}
mutate {
remove_field => ["message", "@timestamp"]
}
json {
source => "[@metadata][messageline]"
}
if "_jsonparsefailure" in [tags] {
drop {}
}
date {
match => ["logdate", "yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ"]
}
}
output {
elasticsearch {
hosts => ["elasticsearch:9200"]
index => "logs-%{+yyyy-MM-dd}"
document_type => "applicationlogs"
}
}
