Logstash 7.1 indexing to elasticsearch problem

Elastic Stack Logstash
1

Hi guys,

I got a problem on logstash 7.1
Before that in logstash 6.7, i do not have this problem. My indexing name is logstash-2019.x.x
My logstash 7.1 index to elasticsearch is only one index file instead of everyday create one index file. Now the indexing name is logstash, and keep all the data in one file only.

Is it my output config is wrong?

below are my logstash config,

   input {
      tcp {
        port => 5514
        type => syslog
      }
      udp {
        port => 5514
        type => syslog
        }
    }

filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => [ "received_at", "%{@timestamp}" ]
      add_field => [ "received_from", "%{host}" ]
    }
    date {
      match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
    }
  }
}

output {
  elasticsearch { hosts => ["10.3.3.41:9200"] }
  stdout { codec => rubydebug }
}
2

Add to elasticsearch output this line "index => "index-name-%{+YYYY.MM.dd}""

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.