i'm using elasticsearch 5.6.0 with logstash and filebeats.
i'm trying to index my files by the pattern "filebeat-" and then the source file name.
when i used a simple string like "hello" the file got indexed correctly. when i tried to add the filename to the index non of it was received in elasticsearch discovery and iwasn't able to find the index.
here is my logstash configfile:
input {
beats {
port => 5044
}
}
filter {
grok {
break_on_match => false
match => { "message" => "some pattern to match file context"
"source" => "some pattern to match filename.log$" "
}
}
mutate { add_field => { "[@metadata][filename]" => "%{filename}" } }
}
output {
elasticsearch {
hosts => ["http://localhost:9200"]
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][filename]}"
document_type => "%{[@metadata][type]}"
user => "elastic"
password => "1234"
}
}
when i used output to stdout with ruby debug i saw that "[@metadata][filename]" had the right name in it.
and the data was parsed as i wanted. only the index is the problem
hope anyone can help.