logging - TTL elastic search not working -
i need put ttl each of logs exported logstash.
i have created folder 'mappings' under config folder, under have folder _default, under have json file default.json, has:
{ "_default_" : { "_ttl" : { "enabled" : true, "default" : "10s" } } }
i exporting logs elastic server logstash. config file is:
input { stdin { type => "stdin-type" } } filter { grok { type => "stdin-type" pattern => "i %{username:username}" add_tag=>"{username}" } } output { stdout { debug => true debug_format => "json"} elasticsearch { } }
i should expect logs deleted elastic search after 10 seconds, not case. logs persist. going wrong? totally stuck.
need help.
fine guys, got work. had change
message %{data}err_system%{data}
to
message %{data}err_system.*
Comments
Post a Comment