Index problem .keyword

Elastic Stack Kibana
5

Ok :slight_smile:

You did not say you were using logstash in the middle so there is more to do...

Yes comment out the logstash output during setup and set elasticsearch output.
Then comment out the elasticsearch output and uncomment the logstash output when running through logstash.

I usually highly recommend to get everything working using the direct architecture.

Filebeat -> Elasticsearch

Before trying and moving on to the more complex architecture.

Filebeat -> logstash -> Elasticsearch

Also since you are using logstash your pipeline needs to be "filebeat" aware please see this doc

You pipeline should look something like

input {
  beats {
    port => 5044
  }
}

output {
  if [@metadata][pipeline] {
    elasticsearch {
      hosts => "http://yourhost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
      pipeline => "%{[@metadata][pipeline]}" 
      user => "elastic"
      password => "secret"
    }
  } else {
    elasticsearch {
      hosts => "http://yourhost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
      user => "elastic"
      password => "secret"
    }
  }
}