At the end, I'm getting parse errors and my message ends up in Elasticsearch by sending the whole message as a column in my index. The idea is to break the 4 data I have in each line into different columns. Not only GrokParseError I receive, but also issues while converting the date.
The @logdate field shouldn't exist, as I want to replace the log entry time from the @timestamp, that means, my timestamp should be pointing to January, not the collected date;
The message should contain only the last field in my log entry, expected would be only "msg"
I see that the additional fields I added are giving me an exclamation sign that the field is not cached
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.