Find some useful tips:
-
Note that if you change ES mappings the changes are applied to new indicies only.
-
Consider checking Logstash logs for errors and warnings:
/var/vcap/sys/log/parser/parser.stdout.log
-
Look into full Logstash conf to understand the full chain of parsing:
/var/vcap/jobs/parser/config/logstash.conf
Here you can find links to common issues that you might meet and how to solve them: