I added the below config to my conf.d/logstash-simple.conf file.
input {
beats {
jdbc {
add_field => { "[index_name]" => "pglogdb" }
add_field => { "[@metadata][beat]" => "jdbc" }
add_field => { "[@metadata][version]" => "1.1" }
tags => ["pglogdb_data"]
#jdbc_driver_library => ""
jdbc_driver_class => "Java::org.postgresql.Driver"
jdbc_connection_string => "jdbc:postgresql://1.6.2.13:5432/pgmessagesuat"
jdbc_user => "pguat"
jdbc_password => "password"
last_run_metadata_path => "/etc/logstash/conf.d/lastrun/.logstash_jdbc_pgmessagesuat_last_run"
schedule => "0,10,20,30,40,50 * * * *"
statement => "SELECT QUERY"
use_column_value => true
tracking_column => "a.transaction_timestamp"
tracking_column_type => "timestamp"
}
...
filter {
if 'pglogdb_data' in [tags] {
mutate {
add_field => { "[index_name]" => "pglogdb" }
}
}
}
...
output {
if ('' in [index_name]) {
elasticsearch {
user => "logstash_input"
password => "password"
hosts => ["https://localhost:9200"]
manage_template => false
index => "%{[index_name]}"
ssl_certificate_verification => false
cacert => "/etc/pki/tls/certs/ca.crt"
ssl => true
} else {
elasticsearch {
user => "logstash_input"
password => "password"
hosts => ["https://localhost:9200"]
manage_template => false
index => "%{[@metadata][indexname]}-%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM-'w'ww}"
ssl_certificate_verification => false
cacert => "/etc/pki/tls/certs/ca.crt"
ssl => true
}
}
}
}
After making the update I ran systemctl restart logstash. When I then went into Discover in Kibana I was unable to see pglogdb in the data view dropdown.
Why is this? Have I missed something?