Index pattern issues

when adding codec = jason_lines can't add an index in elasticsearc

there is no Jason_lines codec plugin in logstash. U mean json_lines plugin?

yes
this is my config :
input {
file {
path => "/var/ossec/logs/alerts/alerts.log"
tags => ["ossec"]
codec => json_lines
}
}
output {
if "ossec" in [tags] {
elasticsearch {
hosts => ["localhost:9200"]
index => "ossec-%{+YYYY.MM.dd}"
}
}
}

for file input use codec => json instead codec => json_lines.

Check this link: https://www.elastic.co/guide/en/logstash/6.0/plugins-codecs-json_lines.html#_description_150

to process file input, its suggestible to use json codec. Ping error if any further.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.