Currently I have a setup that has syslog messages where the source is the MACADDRESS (ie 507E5DC79D8A) As I am using the SYSLOG codec this field is parsed over into the source field.
No problems there but if I try to create overviews (dashboards/widgets) for instance “Aggregating count() by source” with this field as parameter i get the following error:
While retrieving data for this widget, the following error(s) occurred:
- Elasticsearch exception [type=search_phase_execution_exception, reason=all shards failed].
When I select data having an IPaddress as the source field I get a correct count.
So I worked/looked already on a couple of solutions by reading others posts.
- don’t use syslog but create a custom codec using GROK
- try to create a pipeline to parse the source field in a separate “new” field
- try to ignore the source and set the source with the $message.gl2_remote_ip
weirdly enough the pipeline didn’t work, so I starting to look back at what started the problem. Why can’t I somehow not index on this macaddress fields.
Has anybody any ideas, or suggestions to look into.