Logstash keep logging into default index

Elastic Stack Logstash
1

Hello,

I have got an issue with logstash when i want to output logs into elasticsearch.
In my configuration below i specify an index for my logs from filebeat, but it seems that they are finally store in that index AND in the default index configured in Kibana "logstash-XX-XX-XX".

input {
  beats {
    port => 5044
  }
}
filter{
  grok {
    match => [ "message", "(?m)%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:severity} {1,2}%{JAVACLASS:class} %{GREEDYDATA:message}" ]
    overwrite => [ "message" ]
  }
  mutate {
    remove_field => [ "[beat]","input_type","offset" ]
  }

}

output {
  elasticsearch {
    hosts => "d1ccelk01"
    #manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
}

Anybody have an idea of the problem?

Thanks !

2

Is that your entire config or do you have more?

3

yes this is my entire logstash config.

Here is what i get :

Pasted image1588×136 7.09 KB

4

Someone ? Any idea ?

5

I'm pretty sure you have additional configuration files in /etc/logstash/conf.d that you've forgotten about.

6

You're absolutely right! !
I thought that renaming it in *.old make it unavailable for logstash.

Thanks a lot for your help.

1 Like