output {
if "sensu" in [tags] {
elasticsearch {
hosts => ["server"]
sniffing => true
manage_template => false
index => "sensu-%{+YYYY.MM.dd}"
document_type => "sensu"
}
}
}
When I restart the service I cannot see the data anymore in sensu index, if I remove the if clouse if works , what' wrong, I've already define the tag sensu in the input filter, doesn't it work that way?
Can you try inserting as an output stdout { codec => rubydebug }.? That will show you the full event data and let us see if the sensu tag is being deleted somehow. Could a filter be mangling it somewhere?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.