Having issues with the following config file after following a tutorial from someone on the web. Main goal was to take a json file and load into logstash and bring over all fields from the original json file. My input is the json file and the output is elastic search. I tried adding each field as a source => "Something" and then run a mutate {convert => ["Latitude", "float"]} command to convert the double fields into floats so they could be used with Kibana from what I followed. Issue is the config file with all of the fields in like below won't work but if I remove all fields and don't mutate anything I can get the data into logstash just using one source command called source=> "Provider" ----
This config doesn't work:
input {
file {
path => "D:\ElasticSearch\EEN_JSON_TEST\OUTPUT\output2016_01.json"
type => "json"
start_position => "beginning"
}
}
filter{
json
{
source => "Latitude"
source => "Longitude"
source => "Accuracy"
source => "DateTime"
source => "Provider"
source => "Bearing"
source => "Acce_X"
source => "Acce_Y"
source => "Acce_Z"
source => "Orient_X"
source => "Orient_Y"
source => "Orient_Z"
source => "TimeRaw"
source => "DeviceID"
source => "Manufacturer"
source => "GeoTags"
source => "Speed_Cal"
source => "Exc_Model_Cal"
source => "Operator_Cal"
source => "Risk_Dyn_Cal"
source => "Speed"
source => "Model"
source => "Version"
source => "Username"
source => "ValID"
}
mutate {convert => ["Latitude", "float"]}
mutate {convert => ["Longitude", "float"]}
mutate {convert => ["Speed_Cal", "float"]}
mutate {convert => ["Risk_Dyn_Cal", "float"]}
mutate {convert => ["Speed", "float"]}
}
output {
elasticsearch {
action => "index"
host => "localhost"
index => "EEN"
}
stdout {}
}
This config does but not sure it is correct and not sure it allows me to do what I want to do in Kibana:
input {
file {
path => "D:\ElasticSearch\EEN_JSON_TEST\OUTPUT\output2016_01.json"
type => "json"
start_position => "beginning"
}
}
filter{
json
{
source => "Provider"
}
}
output {
elasticsearch {
action => "index"
hosts => "localhost"
index => "eenindigo"
}
stdout {}
}
Thanks in Advance. Jason
