Some fields miss getting appended by ".keyword" when you see them on Kibana after parsing it through logstash

Elastic Stack Elasticsearch
1

parsed fields:
{
"lastModifiedDate" => nil,
"credentials" => nil,
"thumbprint" => nil,
"certificate" => nil,
"messageId" => "123",
"errorInfo" => nil,
"serviceName" => "CCMSService.GET_RUDI",
"transactionId" => nil,
"createdDate" => "2018-06-07T13:02:31.023Z",
"@timestamp" => 2018-07-03T13:42:59.770Z,
"randomNumber" => nil,
"@version" => "1",
"id" => "5b39c8075010d719bc7e250a",
"rudi" => "GTIN-76378664",
"errorcode" => nil,
"requestStatus" => nil,
"actionName" => "Get",
"status" => nil
}

image
image.png1354×635 36.1 KB

The field is not listed on the dropdown while creating visualizations on Kibana.

2

It depends on the mapping that has been generated I guess. What is it?

3

Hey David,

I have not created any mapping as such, I just allowed the indexes to be created and the fields to be shown on kibana.

conf file is as follows:
input {
rabbitmq {
host => "10.136.113.168"
port => "32002"
queue => "elk.test.dnd.queue"
heartbeat => 30
durable => true
password => "admin"
user => "admin"
threads => 1
ack => true
codec => "json"
}
}
filter{
mutate{
rename => { "_id" => "id" }
}
}
output {
stdout { codec => rubydebug }
elasticsearch {
hosts => "localhost:9200"
index => "abc-%{+YYYY.MM.dd}"
}
}

4

Can you share the mapping please?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.