I have a on a Windows machine winlogbeat and it's working fine so far. At the moment all logs are going into the same index in elasticsearch. Yes i have searched and found topics with that question but i was unable to solve it.
I want that Logstash is saving winlogbeat documents into a different index.
what is your input section in logstash like? you can tag the beats input events with a winlogbeat tag and the use that in the output section with a conditional
That sounds great. Input in Logstash looks like that:
syslog {
port => 5514
type => "syslog"
}
udp {
type => "pfsense"
port => 5140
}
beats {
type => "log"
port => 5044
}
udp {
type => "syslog"
port => 5515
}
Hmm but it didn't make a new indices now for winlogbeat. If i do: GET /_cat/indices?v in Kibana i only see my logstash indices.
They are comming now in like that:
t _index logstash-2017.06.20
# _score -
t _type wineventlog
I probably have this problem with one field. How should i go to fix that?
Mapping conflict field:
event_data.param1 conflict
Update:
I can't create a new index pattern in Kibana with: logstash-winlogbeat-*
this seem to be problems with how elasticsearch is configured and the already existing data in indices.
can you post error messages somewhere?
also, you can confirm which events are going where by putting a stdout { codec => rubydebug } } before a elasticsearch { .. } block, that will debug the events going to that elasticsearch
you can place the stdout block in different places to see the events that reach that section. example:
input {
beats { }
tcp {}
}
output {
stdout { codec => rubydebug } # option 1: here all events will be logged
if [type] == "winlogbeat" {
stdout { codec => rubydebug } # option 2: here only all events with that tag will be logged
elasticsearch { index => "logstash-winlogbeat-%{YYYY.mm.dd}" }
} else {
elasticsearch { index => "logstash-winlogbeat-%{YYYY.mm.dd}" }
}
}
If you don't see events being printed to stdout it either means data is not arriving in the inputs, or your conditional is not being met (e.g. type isn't really winlogbeat)
Unfortunately I can't create the index. Because I already have a logstash-* Index?
It also shows me the eventlog indices in the searches panel: No matching indices found: [index_not_found_exception] no such index, with { resource.type="index_or_alias" & resource.id="logstash-eventlog-" & index_uuid="na" & index="logstash-eventlog-" }
But i recieve there this message. When I look into the indices via Kibana I can't see a Indices like: logstash-eventlog-*
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.