Skip to content

Instantly share code, notes, and snippets.

@nickwallen

nickwallen/Metron - Squid.md

Created November 23, 2016 18:42
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save nickwallen/2c84a32776a36987e048eaa043191d7d to your computer and use it in GitHub Desktop.
Save nickwallen/2c84a32776a36987e048eaa043191d7d to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Metron - Squid.md

Followed the instructions in the blog series to add Squid.

Create Index Template

We need an index template for Squid so that it interprets the timestamp field as a timestamp. I did not see this in the blog series, but I might have missed.

PUT _template/values
{
  "template": "squid_index*",
  "mappings": {
    "values_doc": {
      "_timestamp": {
        "enabled": true
      },
      "properties": {
        "timestamp": {
          "type": "date",
          "format": "epoch_millis"
        }
      }
    }
  }
}

Configure the Index Pattern in Kibana

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment