kibana - Logstash not adding fields -


i using logstash 1.4.2 , have following conf file.

i expect see in kibana in "fields" section on left options "received_at" , "received_from" , "description", don't.

i see

  • @timestamp
  • @version
  • _id
  • _index
  • _type host path

i see in _source section on right side following...

received_at:2015-05-11 14:19:40 utc received_from:pgp02 descriptionerror1!

so home come these don't appear in list of "popular fields"?

i'd filter right side not show every field in _source section on right. excuse redaction blocks.

screen shot

input {     file {         path => "c:/servererrlogs/office-log.txt"         start_position => "beginning"         sincedb_path => "c:/tools/logstash-1.4.2/office-log.sincedb"         tags =>  ["product_qa", "office"]     }     file {         path => "c:/servererrlogs/dis-log.txt"         start_position => "beginning"         sincedb_path => "c:/tools/logstash-1.4.2/dis-log.sincedb"         tags =>  ["product_qa", "dist"]     }     } filter {      grok {         match => ["path","%{greedydata}/%{greedydata:filename}\.log"]         match => [ "message", "%{timestamp_iso8601:logdate}: %{loglevel:loglevel} (?<logmessage>.*)" ]         add_field => [ "received_at", "%{@timestamp}" ]         add_field => [ "received_from", "%{host}" ]          }     date {         match => [ "logdate", "iso8601", "yyyy-mm-dd hh:mm:ss,sssssssss" ]     }     #logdate parsed timestamp, remove original log message     mutate {         remove_field => ['message', 'logdate' ]         add_field => [ "description", "error1!" ]     } }  output {   elasticsearch {               protocol => "http"     host => "0.0.0.x"   } } 

update:

i have tired searching query like:

tags: data , loglevel : info

then saving query, , reloading page.

but still don't see loglevel appearing 'popular fields'

if fields don't appear on left side, it's kibana caching problem. go settings->indices, select index, , click orange refresh button.


Comments

Popular posts from this blog

IF statement in MySQL trigger -

c++ - What does MSC in "// appease MSC" comments mean? -

javascript - Blogger related post gadget image Resize s72-c [ Need Expert Help ] -