ES is now failing to create my new index at all in spite of the destination definition being practically identical to one that works:
destination d_auth_elastic {
elasticsearch_http(
index("auth_${YEAR}.${MONTH}.${DAY}")
type("_doc")
persist-name("auth")
template("$(format-json --scope nv-pairs --exclude HOST_FROM
--exclude HOST
--exclude srcip*
--exclude SOURCE
--exclude PROGRAM
--exclude 0
--exclude 1
--exclude PID
--exclude LEGACY_MSGHDR
--key ISODATE)\n"
)
);
};
destination d_authm_elastic {
elasticsearch_http(
index("auth-000001")
type("")
template("$(format-json --scope nv-pairs --exclude HOST_FROM
--exclude HOST
--exclude srcip*
--exclude SOURCE
--exclude PROGRAM
--exclude 0
--exclude 1
--exclude PID
--exclude LEGACY_MSGHDR )\n"
)
);
};
log {
source( s_loghost );
parser( p_patterns );
filter( f_classified );
filter( f_ping999 );
filter( f_forti_stats
);
rewrite( r_user1 );
rewrite( r_user2 );
rewrite( r_srcip );
parser( p_srcip );
rewrite( r_srcip_country
);
rewrite( r_srcip_city);
rewrite( r_src_loc);
rewrite( r_ISODATE );
destination( d_auth_elastic
);
destination( d_authm_elastic);
flags( flow-control);
};
d_auth_elastic works fine but d_authm_elastic
never gets created. No errors on the ES end.
Anyone have any clues as to what is going on?
I am at the point of starting tcpdump and looking at what is going over the network.