@Lee_Hinman I don;t see a grok if I get the pipeline by running:
GET _ingest/pipeline/filebeat-7.9.0-elasticsearch-server-pipeline
"filebeat-7.9.0-elasticsearch-server-pipeline" : {
"description" : "Pipeline for parsing elasticsearch server logs",
"processors" : [
{
"rename" : {
"field" : "@timestamp",
"target_field" : "event.created"
}
},
{
"grok" : {
"pattern_definitions" : {
"CHAR" : "."
},
"field" : "message",
"patterns" : [
"^%{CHAR:first_char}"
]
}
},
{
"pipeline" : {
"name" : "filebeat-7.9.0-elasticsearch-server-pipeline-plaintext",
"if" : "ctx.first_char != '{'"
}
},
{
"pipeline" : {
"if" : "ctx.first_char == '{'",
"name" : "filebeat-7.9.0-elasticsearch-server-pipeline-json"
}
},
{
"script" : {
"params" : {
"minutes_unit" : "m",
"seconds_unit" : "s",
"milliseconds_unit" : "ms",
"ms_in_one_s" : 1000,
"ms_in_one_m" : 60000
},
"lang" : "painless",
"source" : """if (ctx.elasticsearch.server.gc != null && ctx.elasticsearch.server.gc.observation_duration != null) {
if (ctx.elasticsearch.server.gc.observation_duration.unit == params.seconds_unit) {
ctx.elasticsearch.server.gc.observation_duration.ms = ctx.elasticsearch.server.gc.observation_duration.time * params.ms_in_one_s;
}
if (ctx.elasticsearch.server.gc.observation_duration.unit == params.milliseconds_unit) {
ctx.elasticsearch.server.gc.observation_duration.ms = ctx.elasticsearch.server.gc.observation_duration.time;
}
if (ctx.elasticsearch.server.gc.observation_duration.unit == params.minutes_unit) {
ctx.elasticsearch.server.gc.observation_duration.ms = ctx.elasticsearch.server.gc.observation_duration.time * params.ms_in_one_m;
}
} if (ctx.elasticsearch.server.gc != null && ctx.elasticsearch.server.gc.collection_duration != null) {
if (ctx.elasticsearch.server.gc.collection_duration.unit == params.seconds_unit) {
ctx.elasticsearch.server.gc.collection_duration.ms = ctx.elasticsearch.server.gc.collection_duration.time * params.ms_in_one_s;
}
if (ctx.elasticsearch.server.gc.collection_duration.unit == params.milliseconds_unit) {
ctx.elasticsearch.server.gc.collection_duration.ms = ctx.elasticsearch.server.gc.collection_duration.time;
}
if (ctx.elasticsearch.server.gc.collection_duration.unit == params.minutes_unit) {
ctx.elasticsearch.server.gc.collection_duration.ms = ctx.elasticsearch.server.gc.collection_duration.time * params.ms_in_one_m;
}
}"""
}
},
{
"set" : {
"field" : "event.kind",
"value" : "event"
}
},
{
"set" : {
"value" : "database",
"field" : "event.category"
}
},
{
"script" : {
"lang" : "painless",
"source" : """def errorLevels = ['FATAL', 'ERROR']; if (ctx?.log?.level != null) {
if (errorLevels.contains(ctx.log.level)) {
ctx.event.type = 'error';
} else {
ctx.event.type = 'info';
}
}"""
}
},
{
"set" : {
"field" : "host.name",
"value" : "{{elasticsearch.node.name}}",
"ignore_empty_value" : true
}
},
{
"set" : {
"value" : "{{elasticsearch.node.id}}",
"ignore_empty_value" : true,
"field" : "host.id"
}
},
{
"remove" : {
"field" : [
"elasticsearch.server.gc.collection_duration.time",
"elasticsearch.server.gc.collection_duration.unit",
"elasticsearch.server.gc.observation_duration.time",
"elasticsearch.server.gc.observation_duration.unit"
],
"ignore_missing" : true
}
},
{
"remove" : {
"ignore_missing" : true,
"field" : [
"elasticsearch.server.timestamp",
"elasticsearch.server.@timestamp"
]
}
},
{
"remove" : {
"field" : [
"first_char"
]
}
}
],
"on_failure" : [
{
"set" : {
"field" : "error.message",
"value" : "{{ _ingest.on_failure_message }}"
}
}
]
}
And there is all default install and setup, as installed filebeat, ran filebeat setup (to load default index and template)..
And then started sending the data to elastic.. So where exactly should I see the grok in the pipeline?