Hi,
I want to change my test_log_time field type from String to date and when I start Logstash it shows it's okay but Kibana still shows String even if I refresh the page.
my config file:
input {
beats {
port => "5044"
}
}
filter {
if "asd123" in [tags] {
dissect {
mapping => {
message => '%{log_timestamp} %{+log_timestamp} %{s-ip} %{cs-method} %{cs-uri-stem} %{cs-uri-query} %{s-port} %{cs-username} %{c-ip} %{cs-user-agent} %{cs-referer} %{response} %{sc-substatus} %{sc-win32-status} %{time-taken}'
}
}
}
else if "apache" in [tags] {
dissect {
mapping => {
message => '%{}"%{}":"%{clientip} %{} %{} [%{timestamp}] "%{verb} %{request} %{}" %{response} %{bytes}%{}","%{}":"%{}","%{}":"%{}"%{}'
}
}
}
else if "test" in [tags] {
dissect {
mapping => {
message => '%{test_log_time} %{+test_log_time} %{packet_persec} %{diff}'
}
}
date {
match => ["test_log_time","yyyy-MM-dd HH:mm:ss"]
}
}
}
output {
elasticsearch {
hosts => [ "localhost:9200" ]
user => ----------
password => ---------
}
stdout { codec => rubydebug }
}
my example log:
2019-05-23 10:22:24 702281827 905