Sending Extracted Fields to Kibana

Elastic Stack Logstash
1

Hi,

i have modified the logstash configuration file to extract some fields. The extracted fields are dispalying in logstash.stdout file but are not showing in kibana.

my configuration file is like this:

filter {
if [type] == "cloudera" {
grok {

  match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
  add_field => [ "received_at", "%{@timestamp}" ]
  add_field => [ "received_from", "%{host}" ]
}
syslog_pri { }
date {
  match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
}

output {
elasticsearch { host => localhost }
stdout { codec => rubydebug }
}
how to send these extracted fields from logstash to kibana?

2

Which fields in particular?

3

Thanks for the reply.
I want to display the fields received_at and received_from in kibana.

4

@timestamp is only generated when the doc is sent to Elasticsearch, so that add line won't work..

Are you seeing the received_from field in stdout?

5

yes, i'm seeing received_from in stdout

here is my ouput:

6

Then it'll be uploaded to ES and visible via KB.

Can you not see this in the documents under the Discover tab?

7

No,these fileds are not displaying under Discover tab.

Do i need to do any other changes to send these fields to kibana?

8

Try refreshing your fields under the index settings?

9

Thanks Mark Walkom,

Now,I'm getting extracted fields in Kibana.