Hi Masters,
I'm trying to use Logsash with "elasticsearch" input for taking specific events from winlogbeat Index and write them to another Index,
I have a problem with the "query" on the input section,
when I'm trying to query something except this:
query => '{ "query": { "query_string": { "query": "*" } } }'
im getting EROORs or Logstsash failed to start.
For logstash constantly stopping after start,
Based on the logs, it seems that this is your only pipeline, logstash will start and stop after it finishes it's job as nothing else require it to do.
Just to cross check, could you also share your pipeline.yml
Can you do a search on index "winlogbeat-2021.04.09-000453-copy" to see if "event.code 4625” successfully indexed into this index?
If no, can you do a GET search on Devtools with the same query?this is to check if there's any logs with event.code 4625 also to check if syntax of the query is correct.
Thanks Kavierkoo,
i had confused and i didn't see the events,
it works like a charm,
do you know how can i run it continuously on the last 5 minutes every time?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.