Skip to content

set the elasticsearch query period  #117

Open
@yoongyoung

Description

@yoongyoung

I'd like to set the period at which the Elasticsearch filter in logstash flies the query.

When data is received through the input, the value of the id field is dropped into the query to obtain the name corresponding to the id from the existing index.

The problem is that the filter runs the query at a slower rate, periodically the result(dashboard field) is displayed as nil.

We need to run queries on every piece of data collected.

  • Version: 6.7
  • Operating System: CentOS
  • Config File (if you have sensitive info, please remove it):
    filter {
    elasticsearch {
    hosts => ["localhost:9200"]
    index => ".kibana"
    query => "_id:/dashboard?/%{[args][objects][id]}"
    fields => {"dashboard" => "dashboard"}
    enable_sort => false
    }

mutate {
add_field => {
"title" => "%{[dashboard][title]}"
}
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions