I have a Winlogbeat --> Logstash --> Azure Data Explorer logging system, but somehow, since last few days, the debug logs that I have activated on logstash is showing that the tmp file written by ADX before the logs are ingested to ADX, is showing a blank file name instead of auto generated time stamp I'm using.
My logstash config is
kusto {
path => "/usr/share/logstash/%{+YYYY-MM-dd-HH-mm-ss}.txt"
ingest_url => "kusto ingest url"
app_id => "AzureAD App Id"
app_key => "Azure AD secret key"
app_tenant => "Azure AD tenant id"
database => "dbname"
table => "tablename"
json_mapping => "jsonmapping"
}
Also, the error showing in the logs is -
[DEBUG] 2021-03-23 11:03:47.905 [[main]>worker2] kusto - Writing event to tmp file.
{:filename=>"/usr/share/logstash/.txt.dbname.tablename"}
Here the .txt.dbname.tablename should have been something like 2021-03-21-03:09:00.txt.dbname.tablename, but it is not coming that way.