care2DavidDPD

# Beats -> Logstash -> Elasticsearch pipeline.

### For reference - was getting an apache error message that was not in the generic pattern
### also a failsafe.
# > cat patterns.d/apache
# HTTPD24_ERRORLOG_ALT \[%{HTTPDERROR_DATE:timestamp}\] \[%{WORD:module}?:%{DATA:loglevel}\] \[pid %{POSINT:pid}(:tid %{NUMBER:tid})?\]( %{DATA:module_file}\(%{DATA:module_file_line}\):)?( \[client %{IPORHOST:clientip}:%{POSINT:clientport}\])? %{GREEDYDATA:message}


input {
  beats {

care2DavidDPD

# To Fix this error in kibana 7.5.1, when having a Filebeat -> LogStash -> elasticsearch, you must manually 
# load the tempalte.

# Failed to load data sources.
#
# Try again
# Error: GraphQL error: [illegal_argument_exception] Fielddata is disabled on 
# text fields by default. Set fielddata=true on [event.dataset] in order to load 
# fielddata in memory by uninverting the inverted index. Note that this can 
# however use significant memory. Alternatively use a keyword field instead.

care2DavidDPD

curl -XPUT -H "Content-Type: application/json" 'https://es1.sjc1.care2.com:9200/filebeat-*/_mapping' -d '{ "mappings": { "type": { "properties": {  "publisher": { "type": "text", "fielddata": true } } } } }' | json_pp
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   484  100   383  100   101   4150   1094 --:--:-- --:--:-- --:--:--  4163
{
   "status" : 400,
   "error" : {
      "reason" : "Root mapping definition has unsupported parameters:  [mappings : {type={properties={publisher={fielddata=true, type=text}}}}]",
      "root_cause" : [
         {

care2DavidDPD

curl 'https://es1.sjc1.care2.com:9200/filebeat-*' | json_pp
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  4642  100  4642    0     0  47683      0 --:--:-- --:--:-- --:--:-- 47855
{
   "filebeat-7.5.1-2019.12.30" : {
      "aliases" : {},
      "mappings" : {
         "properties" : {
            "tags" : {