I need to index my field as type=keyword
as oppose to type=text
, since I need to create dashboard using the fields which are tagged as type text and I am not able to create one.
Below is my config file:
input
{
file {
path => "C:/Users/utkarsh.sanadhya/Desktop/elasticsearch_course/Data/logs/Sixteen.txt"
type => "json"
start_position => "beginning"
}
}
filter {
dissect {
mapping => { "message" => "%{ts} %{+ts} %{+ts} %{a} %{b}: [%{level}][%{c}][%{d}@%{e}: %{msg}" }
}
json { source => "msg" }
}
output
{
stdout {
codec => dots
}
elasticsearch {
}
}
Below is snippet of my log file:
Dec 26 00:32:50 ServerName mars-auth-capture: [INFO ][mars][auth-capture]@cee: {"profile":"http://cee.mitre.org/1.0-beta1/coreprofile","host":"a.b.c.d","pname":"mars-auth-capture","native":{"request_timestamp":"12/26/18 00:20:46","request_protocol":"HTTP/1.1","request_method":"POST","request_url":"/cgi-bin/WebObjects/tsweb-marsweb.woa/6/wo/rdAc6opdpQoEmV4hnQogPM/2.19.1","**request_header_x_forwarded_for**":"e.f.g.h","request_username":"username","response_header_set_cookie":"rdAc6opdpQoEmV4hnQogPM","response_auth_result":"error occurred"}}
I need to create dashboard using fields request_header_x_forwarded_for and request_username from the log file.
Any help/suggestion is appreciated.
Regards,
Utkarsh