Kibana info different when sending to ES directly or with logstash

Elastic Stack Logstash
1

Hi
For some time I have use Serilog => ES => Kibana ... and all is good.
But if I use Logstash like Serilog => Logstash => ES = Kibana I do not get the same output:

ELASTICSEARCH:
add key="serilog:using" value="Serilog.Sinks.Elasticsearch"
add key="serilog:write-to:Elasticsearch.nodeUris" value="http://10.0.0.7:9200"
add key="serilog:write-to:Elasticsearch.templateName" value="myCustomTemplate"
add key="serilog:write-to:Elasticsearch.batchPostingLimit" value="50"
add key="serilog:write-to:Elasticsearch.bufferBaseFilename" value="SerilogElasticBuffer"
add key="serilog:write-to:Elasticsearch.bufferFileSizeLimitBytes" value="5242880"
add key="serilog:write-to:Elasticsearch.bufferLogShippingInterval" value="5000"
Kibana:

image
image.png250×814 8.15 KB

LOGSTASH:
add key="serilog:using" value="Serilog.Sinks.Http"
add key="serilog:write-to:Http.requestUri" value="http://xx.xxx.xx.xx:5043"
add key="serilog:write-to:Http.indexFormat" value="Logstash-{0:yyyy.MM}"
add key="serilog:write-to:Http.AutoRegisterTemplate" value="True"
add key="serilog:write-to:Http.TypeName" value="logevent"
Kibana:
image

Logstash.conf
input {
tcp {
port => 5043
}
}

output {
elasticsearch { hosts => ["localhost:9200"] }
stdout { codec => rubydebug }
}

Where did I go wrong with logstash ?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.