Trouble with json codec and/or date filter

Hi, I'm using ELK for centralized logging and I'm having trouble with a log. I just changed this log from plain text to json format. After I added the JSON codec, I can no longer see logs in kibana.

In the logstash debug logs I can see the logs reaching the input, filters, and output. I'm reformatting for clarity. Other logs from this box are making it to elasticsearch. I can't check the elasticsearch logs because I using the elastic cloud. I'm not sure where else to look.

input {
  file {
    type => "TomcatAccess"
    path => "/data02/logs/localhost_access_log.*"
    codec => json
filter {
  if [type] == "TomcatAccess" {
    date {
      match => ["timestamp", "[dd/MMM/yyyy:HH:mm:ss ZZ]"]
      target => "@timestamp"
output {
    elasticsearch {
      hosts => ""
      user => "user"
      password => "password"
      index => "logs-%{+YYYY.MM.dd}"
  :message=>"Received line", 
  :text=>"{\"host\": \"\",  \"x-forwarded-for\": \"-\",  \"timestamp\": \"[07/Nov/2017:15:21:39 -0800]\",  \"method\": \"GET\",  \"path\": \"/App/testInitialized.cfm\",  \"process_time_ms\": \"49\",  \"status\": \"200\",  \"bytes_sent\": \"1218\",  \"referer\": \"-\"}", 
  :message=>"output received", 
    "timestamp"=>"[07/Nov/2017:15:21:39 -0800]", 

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.