parsing the custom logs #64
Unanswered
sandraimmaculate
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Hi, i have created agent using agent policy and agent enrollment i'm getting the logs stored successfully in Elasticsearch
https://www.elastic.co/guide/en/elasticsearch/reference/current/common-log-format-example.html
i followed the steps mentioned in the document
it displaying the logs in a good format if i do the below steps in Dev tools:
POST my-data-stream/_doc?pipeline=my-pipeline
{
"message": "89.160.20.128 - - [05/May/2099:16:21:15 +0000] "GET /favicon.ico HTTP/1.1" 200 3638 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36""
}
GET my-data-stream/_search?filter_path=hits.hits._source
output:
but when i search for my logs in discover tab
i'm getting the whole entry inside the message field. and displaying the agent details like:
The log entry is being displayed within the "message" field in the Discover tab. The above fields are about my machine where the agent is running
Why its not showing the log entry like how its showing the machine details where the agent is running, do i have to do anything to get the logs in detailed format how i'm getting in Dev tools .
Beta Was this translation helpful? Give feedback.
All reactions