I have my ELK installed and use a logstash file to configure the log txt files. However, when I open kibana, I could not see the .raw field data. How can I see that?
What's the name of the index with your logs?
I didnt include any index field in my conf file.
I have written a logstash conf filefor reading logs. If I use the default index, that is logstash-*, I could see .raw field in kibana. However, if I create a new index in conf file in logstash like
output{
elasticsearch {
hosts => "localhost"
index => "batchjob-*"}
}
Then the new index cant configure .raw field. Is there any resolve ways to solve it? Great Thanks.
Logstash's default index template only applies to indexes whose name matches logstash-*. If you want to name your indexes differently you'll have to modify the index template.
Yes. Thanks for guidance. I have managed to create raw fields again now.
Great thanks.