Logs are not visible in Discover Section

OpenSearch
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):

Describe the issue:
I have logs ingested from Windows machine using fluent-bit but apparently they are not visible in opensearch discover section. However, the index pattern is created and when i try to use the index pattern for analyzing logs, it says No results. Furthermore, I used dev tool to verify if the logs are coming or not and found out that the logs are ingested and stored in opensearch indexer. Below are the screenshot of index pattern and dev tools query.

Configuration:
Fluent bit configuration
[SERVICE]
Flush 2
Log_Level info
Parsers_File parsers.conf

[INPUT]
Name tail
Tag winlog
Path C:\Users\win_agent\Desktop\logfile.log

[FILTER]
Name parser
Match winlog
Key_Name log
Parser winlog_parser

[OUTPUT]
Name opensearch
Match *
Host 192.168.1.132
Port 9200
HTTP_User admin
HTTP_Passwd Strongpassword@1234
Index windows
Logstash_Format true
Logstash_Prefix windows
tls on
tls.verify false
Suppress_Type_Name on
Retry_Limit False
Buffer_Size 200KB
[PARSER]
Name winlog_parser
Format json
Time_Key EventTime
Time_Format %Y-%m-%d %H:%M:%S

Relevant Logs or Screenshots:

1
11661×771 103 KB

2

@saanx In OpenSearch Dashboards Discovery you can view your logs by selected time frame. Could you check the timestamps in your documents? The default time range is the last 15 minutes.

According to your screenshot, the document timestamp is in a different time zone than UTC.
Check which timezone is set in OpenSearch Dashboards.

1 Like
3

Thank you very much, my issue is solved now. I removed Time_Key and Time_Format field from parser and it worked.

1 Like