Logstash codec graphite - not adhereing to settings

Hello, i am trying to ingest graphite metrics from my FreeNAS Server into elasticsearch-7.7 through a logstash-7.7 pipeline.

my configurations are:

    input {
      tcp {
        port => 2003
        type => graphite
        codec => graphite { metrics_format => "servers.%{host}.*" }
    output {
      if "syslog" in [type] {
        [.. snip ..]
      } else if "graphite" in [type] {
        elasticsearch {
          hosts => ["localhost:9200"]
          manage_template => false
          index => "graphite-%{+YYYY.MM.dd}"
      } else {
        [.. snip ..]

Though the actual document that i am receiving is formatted like

    _source": {
        "servers.Yggdrasil.rrdcached.gauge-tree_depth": 11,
        [... snip ...]
        "host": "Yggdrasil.securitybits.local",
        "type": "graphite"

But with the settings for the input codec i expected logstash to actually split the "servers.yggdrasil.rrdcached" But it does not seem to adhere to the proper codec settings. I am currently moving away from influxdb and grafana in order to have all my logs and metrics in the same place.
Would an alternative to this setup be to actually install metricbeat to freenas, i have not seen any mentions of it anywhere though.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.