In filebeat config file, I have added custom dissect as below and restarted the filebeat service but still message show in a single line in the kibana, doesn't split.
Hi @Kumbum. The message field is still going to be added to the index unless you specifically add a drop_fields processor.
But we should make sure that the new fields are being created. Perhaps it will help to use the Simulate Ingest Pipeline API to check if the pattern is successful.
Try running the following in Kibana - Stack Management - DevTools.
Hi @nickpeihl We are writing everything below in the filebeat.yml and are getting an issue where filebeat will not initialize on the client machine with the dissect changes. We ran your code above in the dev tools and it appears the logs are getting parsed out as expected. Do you have any idea why the code pasted below is failing?
Hi @Matthew_Sturtevant. One thing that immediately jumps out to me is the second line. There should be a space between the "-" and "dissect", e.g. - dissect:.
@nickpeihl
We have updated dissect properly(Gave a space) but now unable to restart the filebeat service as it throws the following error. Not sure what misses here.
Hi @Kumbum. I'm not an expert on Filebeat and this error is beyond my knowledge. Do you mind opening a new topic with your details in the Beats category.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.