Thank you for taking the time to respond.
I changed the configuration of Beats to this:
filebeat.prospectors:
- paths:
- /mnt/log/*.log
input_type: log
json.keys_under_root: true
json.add_error_key: true
json.message_key: log
output.elasticsearch:
hosts: ["elasticsearch:9200"]
template.name: filebeat
template.path: filebeat.template.json
This is what the log files look like. Every log is on its own line:
{"error":"dial tcp 172.21.0.2:5432: getsockopt: connection refused","level":"error","msg":"Could not open database connection","time":"2017-03-25T14:57:15Z"}
{"error":"dial tcp 172.21.0.2:5432: getsockopt: connection refused","level":"error","msg":"Could not open database connection","time":"2017-03-25T14:57:18Z"}
{"error":"dial tcp 172.21.0.2:5432: getsockopt: connection refused","level":"error","msg":"Could not open database connection","time":"2017-03-27T16:36:49Z"}
{"error":"dial tcp 172.21.0.2:5432: getsockopt: connection refused","level":"error","msg":"Could not open database connection","time":"2017-03-27T16:36:52Z"}
{"error":"dial tcp 172.21.0.2:5432: getsockopt: connection refused","level":"error","msg":"Could not open database connection","time":"2017-03-27T16:36:55Z"}
Yet still, Kibana only shows a "message" field. I have a strange feeling that I'm using the message_key field in a wrong way. Am I using it right? What do I use as the key?