Hello
I'm pretty new to ELK and installed the whole stack one one machine.
Filebeat and Metricbeat --> Logstash --> Elasticsearch <-- Kibana
Filebeat is working great but today I installed metricbeat. For me it seems, because I'm sending metricbeats trough logstash to elasticsearch that all metrics will be stored in the logstash-* indicies. I have a logstash-* and a metricbeats-* index pattern but if I go to discover in Kibana all Metricbeats Fields appear only if I choose logstash-. If I choose metricbeats- there are no Available or Selected Fields. I think I missed something in /etc/logstash/conf.d/ and send metricbeats data to metricbeats-* instead logstash-*.
You need to add the options to the elasticsearch output as described on the page you linked. These additional outputs specify which index to write the data to. By default data goes to logstash-YYYY.MM.dd but you need it to go to metricbeat-YYYY.MM.dd.
Hello Andrew
I'm trying to send logs from filebeat to indicies logstash-* and data coming from metricbeat to indicies metricbeat-* that's it. IMHO, I think that with the output below everything will be sent to metricbeat-*
output {
elasticsearch {
host => "localhost"
port => "9200"
protocol => "http"
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
After I configured output like this there weren't any messages listed in kibana using indicies logstash-*
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.