Hello everyone, I'm new in the ELK community. I'm trying to setup a kibana sandbox (linux vm). So I've put data into the logstash. I've created index / mapping thanks to the Dev tool.
But when I'm trying to set a default index, kibana don't find any index
So here's the two index I've created. .
Can anyone help me ? or give me a clue ?
EDITED:
It seems that something is misconfigured on the Logstash end
Here's my Input file and my output
Input
input {
beats {
port => 5044
tags => "fromBeats"
}
file {
path => [
"/home/secunix/logs/*",
"/tech/*"
]
start_position => "beginning"
sincedb_path => "/dev/null"
}
tcp {
port => 5514
type => "syslog"
tags => "from Syslog-ng"
}
}
filter {
grok {
match => ["message", "<(?<sys_priority>\d+?)>(?<syslog_timestamp>%{CISCOTIMESTAMP})\s(?<logsource>%{URIHOST})(\s(?:(?<application>.*?)(%(?<project>.*?))?))?:(?:\s)?(?<logmessage>.*$)"]
}
if [logmessage] {
mutate {
replace => [ "message", "%{logmessage}" ]
remove_field => [ "logmessage" ]
}
}
if [project] {
mutate {
replace => [ "type", "%{project}" ]
remove_field => [ "project" ]
}
}else if [application] {
mutate {
lowercase => [ "application" ]
}
mutate {
gsub => [ "application", " ", "_" ]
}
mutate {
replace => [ "type", "%{application}" ]
}
}else {
mutate {
replace => [ "type", "uknapp" ]
add_field => { "application" => "uknapp" }
}
}
}
Output
output {
elasticsearch {
hosts => ["localhost:9200"] //host pour push l’index
index => "logstash-%{+YYYY.MM.dd}" //Nom de l’index à la sortie
#+++ sa Added by scr-sop-af-config-elksandbox. Do not remove this line.
user => "logstash" //Logs de connexion, ne pas toucher
#--- sa Added by scr-sop-af-config-elksandbox. Do not remove this line.
#+++ sa Added by scr-sop-af-config-elksandbox. Do not remove this line.
password => "logstash"
#--- sa Added by scr-sop-af-config-elksandbox. Do not remove this line.
}
}
and this is the kinf of logs i've :
{"index":{"_index":"shakespeare","_id":0}}
{"type":"act","line_id":1,"play_name":"Henry IV", "speech_number":"","line_number":"","speaker":"","text_entry":"ACT I"}
