what could be wrong with this particular config?
i have multiple configs just like this and everything is working except this one
input {
file {
path => [ "${LL_LOG_IMPORT_NGINX:/var/log/remote/ingress-nginx/nginx-access.log}" ]
type => "nginx"
sincedb_path => "${LL_SINCEDB_IMPORT_NGINX:/var/lib/logstash/plugins/inputs/file/nginx-import.sincedb}"
}
}
filter {
if [type] == "nginx" {
grok {
match => {
"message" => "%{TIMESTAMP_ISO8601:loggedtime} %{IPORHOST:host } %{PROG:program}(?:\[%{POSINT:pid}\])?: %{HTTPD_COMBINEDLOG}"
}
}
date {
locale => "en"
match => [ "timestamp", "MMM dd yyyy HH:mm:ss", "MMM d yyyy HH:mm:ss", "dd/MMM/yyyy:HH:mm:ss Z", "ISO8601" ]
}
geoip {
source => "clientip"
}
useragent {
source => "agent"
prefix => "useragent_"
}
mutate {
convert => { "bytes" => "integer" }
}
}
}
output {
elasticsearch {
hosts => ["http://localhost:9200"]
index => "logstash-%{type}-%{+YYYY.MM}"
}
}