我正在嘗試為ELK建立一個簡單的hello世界,并能夠通過網際網路檢視kibana報告.我已經安裝了kibana,logstash,nginx和彈性搜尋.這是我的/etc/logstash/conf.d/10-syslog.conf:
input {
file {
path => [ "/var/log/*.log","/var/log/messages","/var/log/syslog" ]
type => "syslog"
}
}
output {
elasticsearch { host => localhost }
stdout { codec => rubydebug }
}
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
add_field => [ "received_at","%{@timestamp}" ]
add_field => [ "received_from","%{host}" ]
}
syslog_pri { }
date {
match => [ "syslog_timestamp","MMM d HH:mm:ss","MMM dd HH:mm:ss" ]
}
}
}
我可以從網際網路上通路Kibana.但是,我可以看到報告,因為當我點選儀表闆,可視化或發現時Kibana出錯:
Index Patterns: Please specify a default index pattern
我應該如何指定它?我現在隻想保持簡單.