![](/img/trans.png)
[英]Index not creating in kibana for mongodb + logstash +elasticsearch
[英]Logstash issues in creating index remove .raw field in kibana
我寫了一個logstash conf文件來讀取日志。 如果我使用默認索引,即logstash- *,我可以在kibana中看到.raw字段。 但是,如果我在logstash中的conf文件中創建一個新索引
output{
elasticsearch {
hosts => "localhost"
index => "batchjob-*"}
}
然后新索引無法配置.raw字段。 有沒有解決方法可以解決它? 萬分謝意。
原始字段由創建特定的索引模板的Logstash elasticsearch
輸出創造了Elasticsearch。
你可以做的只是將該模板復制到名為batchjob.json
的文件中,並將模板名稱更改為batchjob-*
(見下文)
{
"template" : "batchjob-*",
"settings" : {
"index.refresh_interval" : "5s"
},
"mappings" : {
"_default_" : {
"_all" : {"enabled" : true, "omit_norms" : true},
"dynamic_templates" : [ {
"message_field" : {
"match" : "message",
"match_mapping_type" : "string",
"mapping" : {
"type" : "string", "index" : "analyzed", "omit_norms" : true,
"fielddata" : { "format" : "disabled" }
}
}
}, {
"string_fields" : {
"match" : "*",
"match_mapping_type" : "string",
"mapping" : {
"type" : "string", "index" : "analyzed", "omit_norms" : true,
"fielddata" : { "format" : "disabled" },
"fields" : {
"raw" : {"type": "string", "index" : "not_analyzed", "ignore_above" : 256}
}
}
}
} ],
"properties" : {
"@timestamp": { "type": "date" },
"@version": { "type": "string", "index": "not_analyzed" },
"geoip" : {
"dynamic": true,
"properties" : {
"ip": { "type": "ip" },
"location" : { "type" : "geo_point" },
"latitude" : { "type" : "float" },
"longitude" : { "type" : "float" }
}
}
}
}
}
}
然后你可以像這樣修改你的elasticsearch
輸出:
output {
elasticsearch {
hosts => "localhost"
index => "batchjob-*"
template_name => "batchjob"
template => "/path/to/batchjob.json"
}
}
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.