Re: Kibana 3 and changing the default field from _all to message

2014-06-13 Thread Brian
Ok, it's not a Kibana issue, but my Elasticsearch configuration issue. I could fix it in the elasticsearch.yml file, but I believe it's much safer to fix it in my less-likely-to-be-altered start-up script wrapper. So now when I start ES via the bin/elasticsearch script, but only on behalf of th

Kibana 3 and changing the default field from _all to message

2014-06-13 Thread Brian
I have this typical document being indexed by logstash. The following shows the document in rubydebug mode and not as JSON, but when converted to JSON and indexed the field names and values are the same (in other words, the syntax below isn't one-line JSON but it's clearer to read): { "m