I added autodetect_column_names to the csv block on the filter to automatically detect the head value, but the index on kibana appears column2, column3 ... , what is the cause?
config
nput {
file {
path => ["/usr/share/logstash/DataSet/TBrain_IPS.csv"]
close_older => 3600
codec => "plain"
delimiter => "n"
discover_interval => 30
enable_metric => true
id => "ips"
max_open_files => 5
sincedb_path => "/dev/null"
sincedb_write_interval => 15
start_position => "beginning"
stat_interval => 7200
tags => "ips"
type => "ips"
}
}
filter {
csv {
separator => ","
autodetect_column_names=> true
skip_empty_columns=> false
skip_empty_rows=> false
skip_header=> false
periodic_flush => true
id => "csv"
}
if [tags] == "ips" {
mutate {
convert => {
"event_protocol_id" => "integer"
}
rename => {
"event_rule_reference" => "event_rule_referenceCVE"
}
split => {
"event_rule_reference" => ";"
}
}
}
}
output {
elasticsearch {
hosts => "elasticsearch:9200"
document_type => "ips-csv"
index => "ips-%{+YYYY.MM.dd}"
}
stdout {
codec => rubydebug
}
}