Index pattern issues


(Bakkali Amine) #1

when adding codec = jason_lines can't add an index in elasticsearc


(Eshwar Kumar ) #2

there is no Jason_lines codec plugin in logstash. U mean json_lines plugin?


(Bakkali Amine) #3

yes
this is my config :
input {
file {
path => "/var/ossec/logs/alerts/alerts.log"
tags => ["ossec"]
codec => json_lines
}
}
output {
if "ossec" in [tags] {
elasticsearch {
hosts => ["localhost:9200"]
index => "ossec-%{+YYYY.MM.dd}"
}
}
}


(Eshwar Kumar ) #4

for file input use codec => json instead codec => json_lines.

Check this link: https://www.elastic.co/guide/en/logstash/6.0/plugins-codecs-json_lines.html#_description_150

to process file input, its suggestible to use json codec. Ping error if any further.


(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.