Hi,
I have setup ELK stack with 7.0 version.
When I setup it created index with name logstash-2019.06.16-000001 post that its not create any indexes for 17th June. All the new data generated for 17th june is written to the 16 index.
Can you please help me how I can resolve this issue?
Everything was working fine with ELK 6.6 version.
Below is the logstash config details.
input{
beats{
port => 5151
}
}
filter
{
if [atomtype] == "or_ash" {
grok {
###patterns_dir => "E:\software\patterns"
#pattern => "%{OR_ASH}"
match => {"message" => ["%{WORD:database_name}%{SPACE};%{SPACE}%{BASE10NUM:or_no_of_cpus:int}%{SPACE};%{DATESTAMP:snaptime}%{SPACE};%{SPACE}%{BASE10NUM:instance_id:int};%{SPACE}%{BASE10NUM:or_ash_cpu:float};%{SPACE}%{BASE10NUM:or_ash_scheduler:float};%{SPACE}%{BASE10NUM:or_ash_user_io:float};%{SPACE}%{BASE10NUM:or_ash_system_io:float};%{SPACE}%{BASE10NUM:or_ash_concurrency:float};%{SPACE}%{BASE10NUM:or_ash_application:float};%{SPACE}%{BASE10NUM:or_ash_commit:float};%{SPACE}%{BASE10NUM:or_ash_configuration:float};%{SPACE}%{BASE10NUM:or_ash_administrative:float};%{SPACE}%{BASE10NUM:or_ash_network:float};%{SPACE}%{BASE10NUM:or_ash_queueing:float};%{SPACE}%{BASE10NUM:or_ash_cluster:float};%{SPACE}%{BASE10NUM:or_ash_other:float}"]}
}
date {
match => [ "snaptime", "dd/MM/yyyy-HH:mm:ss" ]
timezone => "UTC"
}
mutate {
remove_field => [ "host" ]
}
}
}
output {
elasticsearch {
hosts => ["localhost:9305"]
index => "logstash-%{+YYYY.MM.dd}"
}
stdout { codec => rubydebug }
}
Can someone please help me to solve this problem?
Please let me know if you need any further information.