Hi, I am polling the logstash monitoring api and inserting that data into elasticsearch, I created a mapping so the data field will be set properly.
Logstash 6.0
elasticsearch 6.0
Here is my mapping
PUT _template/test-*
{ "index_patterns": ["test-*"],
"settings": {
"number_of_shards": 1
},
"mappings": {
"perf": {
"properties": {
"@timestamp": {
"type": "date"
}}}}}
Here is an example of the data not complete it is large
{"@timestamp":1512164936313,"host":"00","version":"6.0.0","http_address":"0.0.0.0:9600","id":"a60f0905-9199-40f2-8d73-ae3d1b8d0d06","name":"00","pipelines":{"logs_beat":{"events":{"duration_in_millis":55497,"in":17970,"filtered":17970,"out":17970,"queue_push_duration_in_millis":584},"plugins":{"inputs":[{"id":"efbb387beefb71f878ef594b837750c0602fe991cd1b9eb6e23410968adcdf29","events":{"out":17970,"queue_push_duration_in_millis":584},"current_connections":3,"name":"beats","peak_connections":22}],"filters":[{"id":"6ff00a3a14869a25d90e55401fe322be7cb92fe0248d498c7d9171a73eeaed5f","events":{"duration_in_millis":0,"in":0,"out":0},"patterns_per_field":{"message":1},"name":"grok"},{"id":"20215ad7d4980aece5c8201757697352a58c8b2c4ac018b623fa82d1172346df","events":{"duration_in_millis":0,"in":0,"out":0},"name":"date"},{"id":"d10fecb9f2207c5396806594b81b7af8da1585d5b096e8f751ec225208b722ca","events":{"duration_in_millis":0,"in":0,"out":0},"name":"geoip"},{"id":"b5f141cc4e4ad60a1ac1410733db6cc71c68bf71d2994e8ff7ce9d6cfa6bc949","events":{"duration_in_millis":0,"in":0,"out":0},"name":"date"},{"id":"478abe574f83f583a6a0bcf1c05d60c9ea07d141229cdcca3f35fbb13184a5d3","events":{"duration_in_millis":0,"in":0,"out":0},"patterns_per_field":{"message":7},"name":"grok"}],"outputs":[{"id":"8468a44944d95084c441b100092299e350d1121087ae8f4258247fc21358b42a","events":{"duration_in_millis.......
if i try to create an index pattern it says there is no date field, but i can certainly find the entries
GET test*/perf/_search
{
"query": {
"match_all": {}
}
}
result
{
"took": 2,
"timed_out": false,
"_shards": {
"total": 6,
"successful": 6,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 13,
"max_score": 1,
"hits": [
{
"_index": "test",
"_type": "perf",
"_id": "utEcFGABsZ2obLIRw0Oj",
"_score": 1,
"_source": {
"@timestamp": 1512164936313,
"host": "tf-p-ubu-elk-l-00",
