I am new to elastic stack. Aim is to visualize access logs data in kibana. I have taken a sample apache log from elastic stack documentation and used the following logstash configuration file:
input {
file {
path => "/tmp/access_log"
start_position => "beginning"
}
}
filter {
if [path] =~ "access" {
mutate { replace => { "type" => "apache_access" } }
grok {
match => { "message" => "%{COMBINEDAPACHELOG}" }
}
}
date {
match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
}
}
output {
elasticsearch { hosts => ["localhost:9200"]
user => username
password => password
index => "apache-access.log"
}
stdout { codec => rubydebug }
}
The script is working fine except for the part that some problem is with "timestamp" field.
Index: apache-access.log Shard: 0 Reason: {"type":"illegal_argument_exception","reason":"Fielddata is disabled on text fields by default. Set fielddata=true on [timestamp] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."}
Plz help ASAP. Thank you