Logstash query to elastic

Elastic Stack Logstash
1

I use https://www.elastic.co/guide/en/logstash/current/plugins-filters-elasticsearch.html

For end event I trying to find data from first event

          if [url] {
        elasticsearch {
          hosts => ["${ES_node01}"]
          index => "logstash-mikrotik-*"
          user => "${es_login}"
          password => "${ES_pwd}"
          sort => "@timestamp:desc"
          query => 'vpn_ip:"[src_ip]" and tags:"VPN" and action:"logged in"'
          fields => { "login" => "vpn_possible_login" }
          docinfo_fields => {
            "_id" => "document_id"
            "_index" => "document_index"
            # "login" => "vpn_possible_login"
          }
        }

But as result I retrived

  • event even with wrong action field
  • same wrong result for different src_ip

What is the mistake in query?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.