Unable to see all fields in Kibana

[MaximeP (Maxime Piazzola)]

Hi,

I use logstash to receive syslog data from my network devices but I can not see all the fields I want in the discover menu.

I receive syslogs from a reverse proxy and I would like to see fields like "http_host" or "server_pool_name" which are in my log. I need that fields to make some visualisations.

Does the problem of extracting fields come from logstash?

Here is my logstash conf :

input {
  tcp {
    port => 514
    type => syslog
  }
  udp {
    port => 514
    type => syslog
  }
}

filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => [ "received_at", "%{@timestamp}" ]
      add_field => [ "received_from", "%{host}" ]
    }
    date {
      match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
    }
  }
}

output {
  elasticsearch { hosts => ["localhost:9200"] }
  stdout { codec => rubydebug }
}

Regards,
Maxime

[Brandon_Kobel]

Hey @maxime have you tried refreshing your index pattern in Kibana to see if the fields show up then? To do so, if you go to Management -> Index Patterns, you can select your index pattern and then click the "Refresh Button" to refresh the mappings.

[MaximeP (Maxime Piazzola)]

Hi Brandon,

Yes,I did it, I had extra fields after but still not the ones I want.
The issue come from my logstash conf i think but i don't know how to solved it.

Thanks for your answer