I need to replace a specific string inside a file with the value of an environment variable, but I only get and empty value. Here my code: - template: src: myfile.yml dest: /etc/myfile.yml mode: '0755' - name: Update template env…
I wish to forward logs from remote EKS clusters to a centralised EKS cluster hosting ECK. Versions in use: EKS v1.20.7 Elasticsearch v7.7.0 Kibana v7.7.0 Filebeat v7.10.0 The setup is using a AWS NLB to forward requests to Nginx ingress,…
I'm playing a bit with kibana to see how it works. i was able to add nginx log data directly from the same server without logstash and it works properly. but using logstash to read log files from a different…
Can anybody please help with the grok pattern for below example of logs? 85.85.85.85 webmail.company.com "CN=First Last/O=Company/C=CZ" [14/Dec/2020:05:58:18 +0100] "GET /mail/User.nsf/iNotes/Proxy/?OpenDocument&Form=s_ReadViewEntries&PresetFields=DBQuotaInfo;1,FolderName;($Inbox),UnreadCountInfo;1,SearchSort;DateD,s_UsingHttps;1,noPI;1&TZType=UTC&Start=1&Count=23&resortdescending=6 HTTP/1.1" 200 2054 "https://webmail.company.com/mail/User.nsf/iNotes/Proxy/?OpenDocument&Form=l_ScriptFrame&l=en&gz&CR&MX&TSF=20170318T181650,92Z&TSX=20180206T185427,18Z&EFF=%2FiNotes%2FForms9_x&charset=UTF-8&charset=UTF-8&KIC&ua=safari&pt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" 125 INOTES_LOGIN_ID=First%20Last; Shimmer=SI_TLM:20210209T072811%2C40Z&ST_Counter:3&LAO:mail&SAB:1&CS_TLM:20210209T072831%2C15Z&V_TLM:20210210T080147%2C82Z&DMS:5&ui:X&MOTLM:20210129T113159%2C00Z&DBQS:1503571%2C%207168000%2C%206963200%2C%200%2C%201503571&SPRKL:1&KOSCZ:GTB&FISD:1;…
I'm trying to make filebeat send log to logstash on another machine and I just can't get it to work. This is the filebeat.yml configuration: https://pastebin.com/8a2RtGBa (Using pastebin because of character limit) This is the configuration on the machine that…
I'm following this documentation https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-apache2.html in order to connect an apache web server access log file using file beat to elasticsearch, everything was ok until I changed the path of apache2.yml I got the following error : 2018-09-22T14:21:55.791+0100 ERROR instance/beat.go:691…
I am getting wrong value in @timestamp field for elasticsearch/filebeat. My filebeat pipeline definition curl -H 'Content-Type: application/json' -XPUT "logger:9200/_ingest/pipeline/app_log" -d' { "description" : "Ingest pipeline for Jetty server log", "processors" : [ { "grok": { "field": "message", "patterns": ["%{TIMESTAMP_ISO8601:timestamp}…