logstash No data streams, indices, or index aliases match your index pattern

Viewed 16

I'm trying to set up receiving logs from domain controllers. But there is no kibanet No data streams, indices, or index aliases match your index pattern. curl -XGET 'http://localhost:9200/_search?size=10000&pretty'

{
  "took" : 0,
  "timed_out" : false,
  "_shards" : {
    "total" : 0,
    "successful" : 0,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 0,
      "relation" : "eq"
    },
    "max_score" : 0.0,
    "hits" : [ ]
  }
}

Data is not coming in logstash /etc/logstash/conf.d filter.conf:

filter {
    if "winsrvad" in [tags] {
        if [winlog][event_id] != "5136" and [winlog][event_id] != "5139" and [winlog][event_id] != "5141" and [winlog][event_id] != "5137" and [winlog][event_id] != "4741" and [winlog][event_id] != "4742" and [winlog][event_id$
        drop { }
        }
    }
}

input.conf:

input {
        beats {
        port => 5044
        }
}

output.conf:

output {
    if [type] == "winsrvad" {
        elasticsearch {
            host => "localhost:9200"
            index => "winsrvas-%{+YYYY.MM.dd}"
            user => Logstash
            password => xxxxxxxxx
        }
    ]
}

winlogbeat:

winlogbeat.event_logs:
- name: ForwardedEvents
  forwarded: true

 # ignore_older: 72h

tags: ["winsrvad"]
output.logstash:
  hosts: ["192.169.1.30:5044"]

#logging.level: info
#logging.to_files: true
logging.files:
  path: C:\ProgramData\winlogbeat\logs
 # name: winlogbeat.log
 # keepfiles: 3
0 Answers
Related