I'm using following system/package:
$ cat /etc/redhat-release
CentOS Linux release 7.2.1511 (Core)
$ rpm -q filebeat
filebeat-1.3.0-1.x86_64
$
with /etc/filebeat/filebeat.yml
:
$ cat /etc/filebeat/filebeat.yml
filebeat:
prospectors:
-
paths:
- /var/log/*.log
input_type: log
registry_file: /var/lib/filebeat/registry
output:
elasticsearch:
hosts: ["localhost:9200"]
shipper:
logging:
to_syslog: true
files:
$
"message": "Sep 8 10:20:01 X CROND[11586]: (root) CMD (/usr/lib64/sa/sa1 1 1)",
- How can I use
timestamp
from message as@timestamp
in Kibana? - How can I separate out rest of message (daemon, etc.) into separate fields?