Hello, everyone. I have been building an elk environment recently, but I have encountered a problem. My logstash agent output log is as follows:
{
"level" => "WARN",
"uuid" => "109933",
"path" => "/usr/local/deploy/intelligent/logs/spring.log",
"@version" => "1",
"@timestamp" => 2018-11-14T09:37:47.483Z,
"type" => "znpz",
"timestamp" => "2018-11-14 17:37:31.345 ",
"message" => "2018-11-14 17:37:31.345 WARN 109933 --- [AlarmTimer] c.c.i.service.Impl.ShowIpranServiceImpl : ip:NeName = 1233-NGN-SW3-XZ-S9306-A",
"host" => "ZNZD-CORE"
}
you want the level field to appear in the kibana management interface, but there is no display, such as screenshot
ask God for guidance
the specific configuration is as follows:
logstash agent:input {
file {
path => ["/usr/local/deploy/intelligent/logs/spring.log"]
type => "znpz"
discover_interval => "15"
sincedb_path => "/opt/deploy/logstash-6.4.3/.sincedb"
start_position => "beginning"
}
}
filter {
grok {
match => { "message" => "%{DATA:timestamp} %{LOGLEVEL:level} %{DATA:uuid} %{DATA:message}" }
}
}
output {
kafka {
bootstrap_servers => ["XXXX"]
topic_id => "znpz"
compression_type => "snappy"
codec => "plain"
}
stdout {}
}
logstash server :
input {
kafka {
bootstrap_servers => ["172.25.241.229:9092,172.25.241.230:9092,172.25.241.231:9092"]
auto_offset_reset => "latest"
topics => ["znpz"]
codec => "plain"
consumer_threads => "3"
decorate_events => true
type => "znpz"
}
}
output {
elasticsearch {
hosts => ["172.25.241.229:9200"]
manage_template => false
index => "logstash-%{type}-%{+YYYY.MM.dd}"
document_type => "%{type}"
}
}
really, need help!
