Logstash crashed down the elasticsearch

Elastic Stack Logstash
1

I use a logstash to fetching the data from the elasticsearch.
The logstash works well when I use an empty filter. But it crashes the remote elastic when I add a json filter.
The logstash.cong is as follow:

input{
elasticsearch{
hosts => "10.117.6.7"
}
}

filter{
json{
source => "message"
}
}

output{
stdout{codec => rubydebug}
}

2

It would be very unusual for you to need a json filter to parse the [message] field from an elasticsearch input. It is possible, but unusual.

What do you mean by "it crashes the remote elastic".

3

I mean when I create a logstash above, the elastic I am fetching from(in this case the elastic in 10.117.6.7) crashed down (closed ).

If I want to read the "message" field from the elastic and filter on it, which filter I would use?

4

OK, if elasticsearch crashes I would expect it to log a message explaining why. You should open a thread in the elasticsearch forum including the message and asking for help with it.

If the [message] field contains JSON then a json filter is OK.

5

Thanks, the problem has been solved. I delete some white space in the filter and use grok instead.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.