Hi,
I'm new user of ES Stack.
I've configure Kibana with Elasticsearch, Logstash and filebeat ( on host )
I have Nginx and MariaDB server which I would like to see in Kibana
I see all beats from server in Discover but I have a probolems with Dashboards
Dashboard for Nginx works well but Mysql not working.
In "Discover" I see log from Mysql but in field message, there is no firled Mysql.xxxx like with Nginx:
Ive got information that grok parse failure
This is my ingest for mysql:
{
"description": "Pipeline for parsing MySQL slow logs.",
"processors": [{
"grok": {
"field": "message",
"patterns":[
"^# User@Host: %{USER:mysql.slowlog.user}(\\[[^\\]]+\\])? @ %{HOSTNAME:mysql.slowlog.host} \\[(%{IP:mysql.slowlog.ip})?\\](\\s*Id:\\s* %{NUMBER:mysql.slowlog.id})?\n# Query_time: %{
NUMBER:mysql.slowlog.query_time.sec}\\s* Lock_time: %{NUMBER:mysql.slowlog.lock_time.sec}\\s* Rows_sent: %{NUMBER:mysql.slowlog.rows_sent}\\s* Rows_examined: %{NUMBER:mysql.slowlog.rows_exa
mined}\n(SET timestamp=%{NUMBER:mysql.slowlog.timestamp};\n)?%{GREEDYMULTILINE:mysql.slowlog.query}"
],
"pattern_definitions" : {
"GREEDYMULTILINE" : "(.|\n)*"
},
"ignore_missing": true
}
}, {
"remove":{
"field": "message"
}
}, {
"date": {
"field": "mysql.slowlog.timestamp",
"target_field": "@timestamp",
"formats": ["UNIX"],
"ignore_failure": true
}
}, {
"gsub": {
"field": "mysql.slowlog.query",
"pattern": "\n# Time: [0-9]+ [0-9][0-9]:[0-9][0-9]:[0-9][0-9](\\.[0-9]+)?$",
"replacement": "",
"ignore_failure": true
}
}],
"on_failure" : [{
"set" : {
"field" : "error.message",
"value" : "{{ _ingest.on_failure_message }}"
}
}]
}
This is line of my mysql-slowlog:
//# Time: 180309 12:58:07
//# User@Host: user[user] @ HOST [IP]
//# Thread_id: 91244 Schema: database QC_hit: No
//# Query_time: 0.000603 Lock_time: 0.000201 Rows_sent: 1 Rows_examined: 0
// Rows_affected: 0
//SET timestamp=1520596687;
//SELECT ................................FROM table;
What a problem is with it?