Hi ,
I also tried to put the time filter after the json filter (with and without target).
I can see the new loaded index with the new record under the list of indexes in the ElasticSearch (using the command curl 'localhost:9200/_cat/indices?v') but I can't reach the data in the Kibana
filter{
json {
source => "message"
}
}
filter{
date {
match => ["startTime", "UNIX"]
target => "@timestamp"
}
}
The time is added automatically as the load time of the data into the ElasticSearch , I don't define in the conf file or in the Json file this field (It's also not part of the fields of the index_client I create).
I also tried the following things:
- to change the startTime in the Json file to string
- create 1 filter and put the data after the json
It still doesn't work.
BR,
Chen