[Issue]: Inaccurate content in Parse and Route Logs page

[stevhutc2016]

Type of issue

None

What documentation page is affected

https://www.elastic.co/docs/solutions/observability/logs/parse-route-logs#observability-parse-log-data-configure-a-data-stream-with-an-index-template

What happened?

Following this example as closely as possible, after the initial section which sets @timestamp, and after setting the index template and updating the pipeline - the _simulate call produces correct result, but the query call NEVER returns any hits.

First, create datastream with one document (creating NEW datastream to remove prior work)

POST logs-example2-default/_doc
{
"message": "2023-08-08T13:45:12.123Z WARN 192.168.1.101 Disk usage exceeds 90%."
}

I'd like to show the results, but it seems Chrome does not support copy/paste from the right-side pane.

Some bug in Chrome?

I'd use Firefox - but it has the bug of not recognizing elastic auth cookies now - so this is SOL

What are we supposed to do now?

Additional info

No response

[mdbirnstiehl]

Hi @stevhutc2016, thanks for creating this ticket. I overlooked that the Extract structured fields section has you create a data stream by running this command:

POST logs-example-default/_doc
{
"message": "2023-08-08T13:45:12.123Z WARN 192.168.1.101 Disk usage exceeds 90%."
}

This causes issues because the ingest pipeline and index template need to be created before the the data stream in order for the data stream to run through the correct default pipeline. You should be able to fix this by deleting the logs-example-default data stream and recreating it after you've created the pipeline and index template. Basically, if you start at the Extract the @timestamp field section after deleting the logs-example-default data stream, everything should work correctly.

Sorry about the confusion, and I'll update the docs to avoid this issue.