A beginner elk, sets up a log collection look and encounters doubts when presenting the data.
my logstash has set up two pipeline,rabbitmq and two http input:
input {
rabbitmq {
host => "rabbitmq"
subscription_retry_interval_seconds => 5
queue => "hello"
}
}
-sharp The filter part of this file is commented out to indicate that it
-sharp is optional.
-sharp filter {
-sharp
-sharp }
output {
elasticsearch {
hosts => "elasticsearch:9200"
manage_template => false
index => "rabbitmq-log-test-%{+YYYY.MM.dd}"
}
}
input {
http {
additional_codecs => {"application/json"=>"json"}
port => 8080
threads => 2
}
}
-sharp The filter part of this file is commented out to indicate that it
-sharp is optional.
-sharp filter {
-sharp
-sharp }
output {
elasticsearch {
hosts => "elasticsearch:9200"
manage_template => false
index => "http-log-test-%{+YYYY.MM.dd}"
}
}
rabbit write data: {"site": "a", "level": "error", "message": "unknow error", "trace": "sdfsfsf"}
http write data: {"site": "b", "error": "adsfsdf", "trace": "asdsfdsf"}
Index of Elasticsearch
Kibana:
Kibana discover:
I want to ask, my kibana search mode does not have http-log data, why does http-log data appear in the discover data list?