Logsatsh reading logs but not showing in kibana

Elastic Stack Kibana
1

Logsash is giving

[root@localhost bin]# /usr/share/logstash/bin/logstash -f logstash.conf
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs to console
19:38:19.250 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://localhost:9200/]}}
19:38:19.254 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://localhost:9200/, :path=>"/"}
19:38:19.382 [[main]-pipeline-manager] WARN logstash.outputs.elasticsearch - Restored connection to ES instance {:url=>#<URI::HTTP:0x56831f79 URL:http://localhost:9200/>}
19:38:19.383 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - Using mapping template from {:path=>nil}
19:38:19.720 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - Attempting to install template {:manage_template=>{"template"=>"logstash-", "version"=>50001, "settings"=>{"index.refresh_interval"=>"5s"}, "mappings"=>{"default"=>{"_all"=>{"enabled"=>true, "norms"=>false}, "dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword"}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date", "include_in_all"=>false}, "@version"=>{"type"=>"keyword", "include_in_all"=>false}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}}
19:38:19.731 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>[#<URI::Generic:0x41414c0f URL://localhost:9200>]}
19:38:19.828 [[main]-pipeline-manager] INFO logstash.pipeline - Starting pipeline {"id"=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>500}
19:38:19.857 [[main]-pipeline-manager] INFO logstash.pipeline - Pipeline main started
19:38:19.924 [Api Webserver] INFO logstash.agent - Successfully started Logstash API endpoint {:port=>9600}

but not showing in kibana

2

Not sure I understand the issue. You have started Logstash, but are you putting data into it? Have you verified that the data is making it into elasticsearch?

I would recommend the /_cat/indices API to verify the index exists.
Then, have you added the index pattern into Kibana?

3

could you please post your input and output configuration?
and check if indizes have been created. Maybe the date is malformated not parsed correctly.

You could also try to set rubydebug as filter, than you can see what logstash is doing with your event.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.