realrobmorris
commented
8 years ago changed up the logstash.conf file.
input {
beats {
port => 5044
}
}
filter {
grok {
match => [ "message", "%{GREEDYDATA:message}"]
}
}
output {
stdout {
codec => rubydebug
}
elasticsearch {
hosts => "<ip>:9200"
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
if "OMG" in [message] {
email {
from => "logstash@<host>"
subject => "logstash alert"
to => "<user>@<host>"
via => "sendmail"
body => "Here is the event line that occured: %{message}"
}
}
}by the way, this is what the logstash.stdout says:
{
"message" => [
[0] "Jun 17 14:07:58 <nodehost_redacted> root: This is another message ERROR WARN OMG",
[1] "Jun 17 14:07:58 <nodehost_redacted> root: This is another message ERROR WARN OMG"
],
"@version" => "1",
"@timestamp" => "2016-06-17T18:08:03.667Z",
"type" => "log",
"beat" => {
"hostname" => "<host_redacted>",
"name" => "<host_redacted>"
},
"source" => "/var/log/messages",
"offset" => 56471433,
"fields" => nil,
"input_type" => "log",
"count" => 1,
"host" => "<host_redacted>",
"tags" => [
[0] "beats_input_codec_plain_applied"
]
}
So there seems to be an @timestamp in the logstash.stdout ; so why would the elasticsearch/logstashTesting.log file have the error:
[indices:data/read/field_stats[s]]]; nested: IllegalArgumentException[field [@timestamp] doesn't exist];
Caused by: java.lang.IllegalArgumentException: field [@timestamp] doesn't exist
jamesl1234
Putting this here because there's been no replies in the forums.
First time user of ELK, originally I created an issue against elasticsearch on github, but it was suggested that I bring this issue to this forum, and so here we are.
In my /var/log/elasticsearch/logstashTesting.log file, all I have are entries that begin with this.
[indices:data/read/field_stats[s]]]; nested: IllegalArgumentException[field [@timestamp] doesn't exist]Elasticsearch (ELK) version:
JVM version:
OS version:
Provide logs (if relevant):
logstash config file
elasticsearch config file
kibana config file
Question: So what's going on here? (also, logstash isn't sending the email when the match is found)
Also, FYI.
This am I removed the
manage_template => falsefrom the logstash config file, but I'm still getting the same error. Here's what elasticsearch/logstashTesting.log says.