Hi,
I am new to ELK and struggling to write my first logstash pipeline.
Can anyone help me to write my pipeline with the filter section?Please note that I require the actual log time (e.g 2018-01-23 06:43:48.79851) to create and demonstrate visualization in Kibana.
One line of my log sample is:
[ERROR@[140598203889408]2018-01-23 06:43:48.798511 in src/TMSInfo.cpp(1699)]TMSInfo::GetCorrelationKey: CIN is NULL failed to create corr key based on cin
for mentioned log line you better choose grok patterns. use https://grokdebug.herokuapp.com/ for writing groks and mention them in filter part of logstash conf file.
Hi,Index is being created.But I require the msg timestamp as my @timestamp.
Please find below the section from Kibana.
message:[ERROR@[140598195496704]2018-01-30 21:06:23.589005 in src/TMSInfo.cpp(1699)]TMSInfo::GetCorrelationKey: CIN is NULL failed to create corr key based on cin msg:18-01-30 21:06:23.589005 path:C:\x\x\x\x.log @timestamp:March 1st 2018, 16:34:42.768
Hi,I tried using the date filter to replace my log time with @timestamp,tried changing the Date & Time format in Kibana also.But the problem still exist.I am stuck now.Some help will be much appreciated.
My pipleline and Kibana output is as shown below:
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.