We are not getting log entries in the - kibana after configuring xpack in version 7.1 . below is the logsatsh conf file . Let me know is anything wrong in the configuration . - User -elastic( role - super user)
logstash.yml: - Added below lines in the yml file
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.username: elastic
xpack.monitoring.elasticsearch.password: xxxxxxxxxxxxxxxx
logstash.conf:
input {
file {
path => "/gsa/bldgsa/projects/a/logEvent_2019*"
type => "IVT_syslog"
start_position => "beginning"
sincedb_path => "/tmp/sincedb/ivt_syslogs"
close_older => 0
exclude => "*.gz"
elasticsearch { user => elastic
password => xxxxxxxxxxxxxxxxxxx
}
}
}
filter {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program})?: logEvent [%{WORD:logevent}][%{DATA:protocol}][%{DATA:messagetype}]%{GREEDYDATA:syslog_message}" }
}
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
timezone => "UTC"
}
elasticsearch { user => elastic
password => xxxxxxxxxxxxxxxx
}
}
output {
elasticsearch { hosts => ["localhost:9200"]
user => elastic
password => xxxxxxxxxxxxx
}
stdout { codec => rubydebug }
}