Kibana/Elastic not replacing type.keyword in the dashboard

Elastic Stack Kibana
1

Hi All,
I need some help with my Kibana dashboard. I was using v7.4 of ELK and now had to upgrade to v8.13. One of the problems I'm facing is with my Dashboards in Kibana. Using a custom .config file in logstash, i'm sending data across to elastic, however the type.keyword is not being replaced as i expect.

Here is an extract of my .conf file.

input {
 file {
   path => ["/shared/rxcmon/nbmuser1/logStatsAccess/*_Access.log"]
#   start_position => "beginning"
   type => "AccessLogs"
 }
}

filter {
if [path] =~ "MS7" {
mutate { replace => { type => "MS7" } }
}
if [path] =~ "MS10" {
mutate { replace => { type => "MS10" } }
}
if [path] =~ "MS11" {
mutate { replace => { type => "MS11" } }
}
if [path] =~ "MS12" {
mutate { replace => { type => "MS12" } }
}

The Dashboard below should be replacing "AccessLogs" with the other names except its not.

image
image1902×246 14.7 KB

Please let me know what I'm missing here. TIA.

2

What should be the path value in the filter, /shared/rxcmon/nbmuser1/logStatsAccess/*_Access.log?
From .conf could say neither of cases can be true, so your type is AccessLogs

If you need the path string, it will be in the [log][file][path] field.

3

Thank you for the help. I replaced the [path] with [log][file][path] field (as below ) and it works as expected now.

input {
 file {
   path => ["/shared/rxcmon/nbmuser1/logStatsAccess/*_Access.log"]
#   start_position => "beginning"
   type => "AccessLogs"
 }
}

filter {
if [log][file][path] =~ "MS7" {
mutate { replace => { type => "MS7" } }
}
if [log][file][path] =~ "MS10" {
mutate { replace => { type => "MS10" } }
}
if [log][file][path] =~ "MS11" {
mutate { replace => { type => "MS11" } }
}
if [log][file][path] =~ "MS12" {
mutate { replace => { type => "MS12" } }
}
1 Like