About a day ago by now, my elasticsearch stack stopped accepting parsed nginx logs. Logstash and Elasticsearch are 6.5.4. Here are the filters for these logs: grok { match => {"message" => "%{IP:remote_ip}?,?\s?%{IP:proxy_ip}?,?\s?%{IP:extra_ip}?,?\s?%{COMBINEDAPACHELOG} %{NUMBER: nginx.r…

Maybe, maybe not. You could probably configure a mapping template that would contain a list of date formats. But that's really an elasticsearch question, not a logstash question. There is a lot more expertise on that in the elasticsearch forum.

cheem January 31, 2019, 3:27pm 2

And when a new index was created for the 31st of January, the problem went away and logs are being indexed again. WTH?

Multiple IF conditions - Logstash

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Suddenly unable to import parsed logs from logstash into elasticsearch