Thank you for guidelines.
I updated logstash config file with new filter. And also updated the filebeat.yml with same name.
But still facing the same issues.
filter {
if [type] == "DataLogs" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:DataLogs_timestamp} %{SYSLOGHOST:DataLogs_hostname} %{DATA:DataLogs_program}(?:[%{POSINT:DataLogs_pid}])?: %{GREEDYDATA:DataLogs_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
syslog_pri { }
date {
match => [ "DataLogs_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}
Can you please tell me how to configure logstash without applying filter?
Or any default configuration for logstash.