I'm try to using Security function at ELK. My elastic version is 7.5.1
I'm having a problem with the file config. i can't start logstash
1.First, i enable security in elasticsearch.yml
by added xpack.security.enabled: true
2.Second, at kibana.yml
i edit elasticsearch.username
= "elasctic" and elasticsearch.password
is my set up password
I start service elasticsearch and kibana. still here everythings is ok.
3.Then i run my logstash with the conf below:
input {
file {
path => ["/etc/logstash/handleexception1.txt"]
type => "_doc"
start_position => beginning
}
}
filter {
dissect {
mapping => {
"message" => "%{Date} %{Time} %{INFO} %{Service} Message:%{Message} ExceptionList:%{ExceptionList}"
}
}
}
output {
hosts => ["localhost:9200"]
index => "logstashhhandlerror2"
user => "elastic"
pasword => "elastic"
}
stdout { codec => rubydebug}
}
acctually i was try both
input {
elasticsearch{
file {
path => ["/etc/logstash/handleexception1.txt"]
type => "_doc"
start_position => beginning
}
user => "elastic"
password => "elastic"
}
}
filter {
elasticsearch{
dissect {
mapping => {
"message" => "%{Date} %{Time} %{INFO} %{Service} Message:%{Message} ExceptionList:%{ExceptionList}"
}
}
user => "elastic"
password => "elastic"
}
}
output {
hosts => ["localhost:9200"]
index => "logstashhhandlerror2"
user => "elastic"
pasword => "elastic"
}
stdout { codec => rubydebug}
}
Here is the screen when i try to start logtash.service
Thanks for reading and hoping you have ask for my problem.
your point 3 config should be working only you need to make one change for index creation, update output:
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "logstashhhandlerror2"
user => "elastic"
pasword => "elastic"
}
stdout { codec => rubydebug}
}
}