1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
{
"streams": [
{
"description": "Root logs stream",
"ingest": {
"failure_store": {
"inherit": {}
},
"lifecycle": {
"inherit": {}
},
"processing": {
"steps": [],
"updated_at": "2025-01-10T08:00:00.000Z"
},
"settings": {},
"wired": {
"fields": {
"@timestamp": {
"type": "date"
},
"log.level": {
"type": "keyword"
},
"message": {
"type": "match_only_text"
}
},
"routing": [
{
"destination": "logs.nginx",
"status": "enabled",
"where": {
"eq": "nginx",
"field": "host.name"
}
}
]
}
},
"name": "logs",
"type": "wired",
"updated_at": "2025-01-10T08:00:00.000Z"
},
{
"description": "Web server access logs, routed by severity",
"ingest": {
"failure_store": {
"inherit": {}
},
"lifecycle": {
"inherit": {}
},
"processing": {
"steps": [],
"updated_at": "2025-01-15T10:30:00.000Z"
},
"settings": {},
"wired": {
"fields": {
"host.name": {
"type": "keyword"
},
"http.response.status_code": {
"type": "long"
},
"message": {
"type": "match_only_text"
}
},
"routing": [
{
"destination": "logs.nginx.errors",
"status": "enabled",
"where": {
"field": "http.response.status_code",
"gte": 500
}
}
]
}
},
"name": "logs.nginx",
"type": "wired",
"updated_at": "2025-01-15T10:30:00.000Z"
},
{
"description": "Legacy application logs",
"ingest": {
"classic": {},
"failure_store": {
"disabled": {}
},
"lifecycle": {
"dsl": {
"data_retention": "30d"
}
},
"processing": {
"steps": [
{
"action": "grok",
"from": "message",
"ignore_missing": true,
"patterns": [
"%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:log.level} %{GREEDYDATA:message}"
]
}
],
"updated_at": "2024-12-01T09:00:00.000Z"
},
"settings": {}
},
"name": "logs-myapp-default",
"type": "classic",
"updated_at": "2024-12-01T09:00:00.000Z"
},
{
"description": "All error-level logs across every stream",
"name": "logs.errors",
"query": {
"esql": "FROM logs* | WHERE log.level == \u0022error\u0022",
"view": "logs.errors-view"
},
"type": "query",
"updated_at": "2025-01-20T14:00:00.000Z"
}
]
}