I finally upgraded to ES 6.5 and was pleasantly surprised by the innovations. Really liked the feature Logs UI (watching logs in real time), but unfortunately I did not find a description of her work. Documentation describes step by step installation from Filebeat to Kibana, but I want to use this feature on my existing indices. Is I understand, they use specific fields from defined indices patterns. (like filebeat-*). Is this parameters configurable?
thanks for trying out version 6.5 of the Elastic Stack!
You're right that the documentation for the Logs UI leaves a lot to be desired.
It is currently designed to work with filebeat out-of-the box. That said, there is some flexibility if you're willing to change the Kibana configuration file (there will be a UI for that soon as well).
- The index pattern used to read log events can be changed via the
xpack.infra.sources.default.logAlias setting, which can contain any index pattern supported by Elasticsearch.
- The timestamp and sorting tiebreaker fields can be changed via the
- The logic to read the message from the individual documents looks at several fields specific to filebeat modules first, but then falls back to the
That means no matter what the ingestion pipeline is, as long as it is possible to formulate an index pattern and structure the documents therein such that they contain timestamp and
@message fields, the Log UI should pick them up, e.g.:
We would be very interested in hearing whether this worked for you and what other improvements you would wish for.
Thanks for the quick response,
yes, in my case I got the expected result, but I agree with you, component need more convenient management (like managment from UI)
Hello could you please clarify where the file
it's a not filename, it's param in
elasticsearch.yml config file
That's how my file now looks like:
"The index pattern can be adjusted via the Kibana configuration file (usually
As @phr0gz correctly points out, these settings have to go into the Kibana config file, not the Elasticsearch config file.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.