Hello,
I have running the ELK Stack in a Docker-compose setup.
thats my setup:
~/local-ELK/logstash main pwd
/home/moep/local-ELK/logstash
Thats my filter in /home/moep/local-ELK/logstash/pipeline/weechat.conf
input {
file {
path => "/usr/share/logstash/mainlog.log/test.weechatlog"
start_position => "beginning"
sincedb_path => "/dev/null"
}
}
filter {
grok {
match => {
"message" => [
# chat messages
"^%{DATESTAMP:timestamp} +--> +%{USERNAME:user}: %{GREEDYDATA:message}",
"^%{DATESTAMP:timestamp} +<-- +%{USERNAME:user}: %{GREEDYDATA:message}",
# system calls
"^%{DATESTAMP:timestamp} +-!\\- +%{GREEDYDATA:event}"
]
}
}
date {
match => ["timestamp", "YYYY-MM-dd HH:mm:ss"]
timezone => "UTC"
}
mutate {
add_field => {
"source" => "weechat"
}
}
}
output {
#stdout { codec => rubydebug }
elasticsearch {
hosts => ["http://elasticsearch:9200"]
user => "kibana"
password => "3last1c"
index => "weechat_index"
}
}
When I use in Kibana the Web Dev Tools and talk directly to the index_weechat
, I get as feedback, that it exists.
But my new index is empty. Whats my problem?
thx