I have following config to fetch Http call and log date at time call was made, but @timestamp shows when log was send from FileBeat server to logstash one.
input {
beats {
port => 5044
}
}
filter {
if [message] !~ /Calling SMC REST API/ {
drop { }
}else {
grok {
match => ["message", "{URIPATHPARAM:request}"]
match => ["message", "%{DATA:timestamp}"]}
date {
match => [ "timestamp", "yyyy-MM-dd HH:mm:ss.SSSS" ] }
}
}
output {
elasticsearch {
hosts => ["http://localhost:9200/"]
index => "smc_calls-%{+YYYY.MM.dd}"
}
}
Tried this too:
input {
beats {
port => 5044
}
}
filter {
if [message] !~ /Calling SMC REST API/ {
drop { }
}else {
date { match => ["@timestamp", "YYYY-MM-dd HH:mm:ss,SSS"] target => "@timestamp" }
grok { match => ["message", "{URIPATHPARAM:request}"]
}
}
}
output {
elasticsearch {
hosts => ["http://localhost:9200/"]
}
stdout { codec => rubydebug }
}
This is message i get in console:
{
"@timestamp" => 2017-04-28T11:30:38.022Z,
"offset" => 15051398,
"@version" => "1",
"input_type" => "log",
"beat" => {
"hostname" => "host of applicaiton",
"name" => "name of host",
"version" => "5.3.1"
},
"host" => "name of host",
"source" => "log-file-name",
"message" => "[2017-04-24 06:43:12,592] @ INFO [jmsContainer-1]other message details",
"type" => "log",
"tags" => [
[0] "beats_input_codec_plain_applied",
[1] "_dateparsefailure",
[2] "_grokparsefailure"
]
}
Please help