В продолжении темы Анализ логов nginx по типу как в awstats не могу дозапустить сборку логов nginx с geoip. Делаю по этому мануалу https://www.ulyaoth.net/resources/tutorial-how-to-install-logstash-and-kibana... убрав только устаревший type nginx access
В логах тоже все ок
{"type":"response","@timestamp":"2016-10-10T16:07:25Z","tags":[],"pid":28795,"method":"get","statusCode":200,"req":{"url":"/elasticsearch/*/_mapping/field/*?_=1476115645823&ignore_unavailable=false&allow_no_indices=false&include_defaults=true","method":"get","headers":{"host":"5.9.27.29:5601","user-agent":"Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:47.0) Gecko/20100101 Firefox/47.0","accept":"application/json, text/plain, */*","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate","kbn-version":"4.6.1","referer":"http://5.9.27.29:5601/app/kibana","connection":"keep-alive"},"remoteAddress":"82.194.10.6","userAgent":"82.194.10.6","referer":"http://5.9.27.29:5601/app/kibana"},"res":{"statusCode":200,"responseTime":5,"contentLength":9},"message":"GET /elasticsearch/*/_mapping/field/*?_=1476115645823&ignore_unavailable=false&allow_no_indices=false&include_defaults=true 200 5ms - 9.0B"}
Если pattern ставить в * , то и Time-field name пусты .