Logstash config with filebeat fields

Elastic Stack Logstash
1

HI,

 I have filebeat installed on all my dev server and qa server in my filebeat config i have added the field as env: dev and env:qa  how do i use this in my logstash config output index pattern. i tried this method but its not working  index =>"%{env} -%{+YYYY.MM.dd}"

Thanks

2

What result to you get? What do you mean by "its not working"?

3

Hi ,

i am getting this error .
Invalid index name [%{env} -2019.01.30]

Thanks

4

That's invalid because it contains a space character, but if that's what you get in the error message it may mean %{env} was not substituted because the env field does not exist.

5

There is a space in the index name and that is not alllowed...

Change

index =>"%{env} -%{+YYYY.MM.dd}"

To

index =>"%{env}-%{+YYYY.MM.dd}"

That should clear up your error...

6

HI,

Since i have added in my filebeats.yml
fields
env: qa

I am getting this same in my output. But still the index pattern is not working as expected . (example env:dev env:qa)

Thanks

7

Have you looked at an event in Kibana? Does it have an env field? If you do not set fields_under_root then you may have [fields][env] instead of [env].

8

Hi,

Yes in my kibana events i am getting as fields.env:qa but still i am not able to index this pattern as qa or dev

Thanks

9

OK. So try

index =>"%{[fields][env]}-%{+YYYY.MM.dd}"
10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.