About a day ago by now, my elasticsearch stack stopped accepting parsed nginx logs. Logstash and Elasticsearch are 6.5.4. Here are the filters for these logs: grok { match => {"message" => "%{IP:remote_ip}?,?\s?%{IP:proxy_ip}?,?\s?%{IP:extra_ip}?,?\s?%{COMBINEDAPACHELOG} %{NUMBER: nginx.r…

Maybe, maybe not. You could probably configure a mapping template that would contain a list of date formats. But that's really an elasticsearch question, not a logstash question. There is a lot more expertise on that in the elasticsearch forum.

Suddenly unable to import parsed logs from logstash into elasticsearch

Elastic Stack Logstash

cheem January 31, 2019, 3:27pm 2

And when a new index was created for the 31st of January, the problem went away and logs are being indexed again. WTH?

Multiple IF conditions - Logstash

Topic		Replies	Views
Logstash parsing with combinedapachelog pattern for nginx Logstash	1	805	February 5, 2020
Logstash not parsing logs into Elasticsearch Logstash	2	343	April 4, 2020
Need Help Parsing Nginx SSL Requests With Grok Logstash	4	352	May 3, 2019
Logstash parse log nginx not index refresh Logstash	1	415	September 17, 2019
Grok filter pattern for nginx Logstash	9	6600	October 4, 2018

Suddenly unable to import parsed logs from logstash into elasticsearch

Related topics