I’m trying to setup ELK:
- elasticsearch-8.10.4-windows-x86_64
- kibana-8.10.4-windows-x86_64
- logstash-8.10.4-windows-x86_64
but i can not add a data view ! i do not even found the (+ create data view) button. After investigations, i found that elasticsearch and kibana are working well but logstash is not printing logs traces in cmd, instead it is showing me this:
[2024-07-05T18:19:14,259][INFO ][logstash.codecs.json ][main][d7fc604f8a1f76fd8f2cc005333dd716dc49d26023548e1b0559de420afeb812] ECS compatibility is enabled but `target` option was not specified. This may cause fields to be set at the top-level of the event where they are likely to clash with the Elastic Common Schema. It is recommended to set the `target` option to avoid potential schema conflicts (if your data is ECS compliant or non-conflicting, feel free to ignore this message)
knowing that, i found in traces:
[2024-07-05T18:14:09,477][INFO ][logstash.inputs.http ][main][d7fc604f8a1f76fd8f2cc005333dd716dc49d26023548e1b0559de420afeb812] Starting http input listener {:address=>"0.0.0.0:5000", :ssl=>"false"}
so i do not know what is the problem.
Here is my logstash.config:
input {
http {
port => 5000
codec => "json"
}
}
filter {
if [message] =~ "WARN|ERROR|INFO" {
grok {
match => { "message" => "%{COMBINEDAPACHELOG}" }
}
}
}
output {
elasticsearch {
hosts => ["http://172.16.12.150:9200"]
}
stdout { codec => rubydebug }
}
PS: i tried to add :
codec => json {
target => "[document]"
}
but it did not resolve the issue. I added also :
input {
http {
port => 5000
ecs_compatibility => disabled
codec => json {
ecs_compatibility => disabled
target => ""
}
}
}
and it did not solve the issue!