[RESOLVED] Custom log in Kibana

[Florius]

Hi. I use software that makes logfiles in /var/log/softwarename/YYYYMMDD/
It uses JSON formatting. But I'm new to Kibana and have no idea how I can read out the log files properly, as I get the log files in a single rule while I should be able to use formatting.

This all sounds very vague, but please see https://www.youtube.com/watch?v=H6dCCw666Xw&t=341s (skip to 2:39).
Hopefully this explains some things...

EDIT: Okay, I did some research and found out that it reads the correct files.
However formatting of it in Kibana is wrong:

So how can I make sure it has proper fields and such, as in the video?

EDIT2: Fixed it. Disabled Logstash and using only Filebeat to parse the JSON files, works perfect!

[weltenwort (Felix Stürmer)]

Hi @Florius,

what tool are you using to ingest the logs into Elasticsearch? Logstash? Filebeat?

[Florius]

Well I actually use both Logstash and Filebeat... I'm not even sure if that's possible but Filebeat prospector gives me the correct files and I try to parse it with Logstash.

(Both Logstash and Filebeat run on the same server as intended, I will be using it only for logfiles on this server.)

[StephenGoodall]

What do you have in your logstash config?
As it's already in JSON format you should just be able to use something like:
{ codec => json_lines }

in your input block