fluent-plugin-elasticsearch：logstash_format true不起作用

Question

I am trying to implement this: http://www.tipstuff.org/2014/01/Postfix-log-centralize-and-analysis-in-realtime-with-fluentd-elasticsearch-and-kibana-part-4.html

I have everything working with this configuration:

<match mail.info>
  type elasticsearch
  log_level debug
  index_name postfix_mail
  type_name postfix_mail
</match>

But when I add logstash_format true, it does not work. I desperately need timestamp in my ES index to get Kibana to work as desired.

<match mail.info>
  type elasticsearch
  log_level debug
  index_name postfix_mail
  type_name postfix_mail
  logstash_format true
</match>

I tried to add verbose logging in td-agent init script (-vv option), but I don't get anything of value there.

Any inputs to resolve this will be highly appreciated.

Answer 1

in your match block, I'm not seeing any details for the elasticsearch server. maybe add that?

docs are here: https://github.com/uken/fluent-plugin-elasticsearch