Index Mismatch

Elastic Stack Kibana
1

I am having an issue with kibana. My setup is a little like this:

  1. Windows Logs from a WEC server
  2. Linux logs including apache and weblogic
  3. Winlogbeat and filebeat with filebeat-* index and winevnt-* index and being ingested on different ports

My problem is that when i upgraded to elastic 6.1.3 from 6.0.0, filebeat-* index is full of windows event logs even and to see the actual logs for filebeat-* index, i am forced to use filters and queries. Is this a bug or are my configurations all weirdly setup?

2

Hi

Can you please paste your config here( sans the sensitive data) . We may help you debug if its a wrong config . It sounds like winlogbeat logs are going to filebeat-?
Anyways either way it's a misconfiguration somewhere - either kibana has an index pattern that's matching all indices () or winlogbeat and filebeat are configured to point to the wrong indices.

Thanks
Rashmi

3

Attached is a screen shot and the config for both windows and linux
apache host.

Thanks

image001.png1171×596 46.6 KB

4

The config was not posted here. Can you re-post it ?

Thanks
Rashmi

5

Here is the text config:

====================================WINLOG
CONFIG=========================

input {
tcp {
port => 6051
codec => json
tags => [ "json" ]
}

stdin { }

}
filter {
if "json" in [tags] {
mutate {
#add_tag => [ "conf_file_0001"]
}
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "winevent-%{+YYYY.MM.dd}"
}
}

==============================APACHE
CONFIG===============================
input {
beats {
port => 5044
}
}

filter {
if [fileset][name] == "access" {
grok {
match => { "message" => "%{IP:client} - -
[%{HTTPDATE:apache_timestamp}] "(?:%{WORD:method}
%{URIPATH:request}(?:?%{NOTSPACE:query_string})?(?:
HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response}
%{WORD:bytes}" }
}
}
else if [fileset][name] == "error" {
grok {
match => { "message" => "[%{DATA:apache_timestamp}]
[%{WORD:type}] [client %{IP:client}] %{GREEDYDATA:log_message}" }
}
date {
match => [ "apache_timestamp" , "EEE MMM dd HH:mm:ss yyyy" ]
}
}
}

output {
elasticsearch {
hosts => ["localhost:9200"]
manage_template => false
index => "apachebeat-%{+YYYY.MM.dd}"
}
}

6

They are different configs btw. One if for recieving windows logs and
the other one is for recieving linux and other application logs
especially apache and others am having. But when i select the
apachebeat* index from the discover console, it displays windows logs
instead which is very odd

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.