Apply filters

Elastic Stack Logstash
1

good afternoon. Recently I started to get acquainted with ELK and aot what is my problem:
I use such a filter


filter {
 if [type] == "syslog" {
    grok {
        match => { "message" => "<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
    }
  }
  date {
        match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
  }
}

I need to filter the log not by the time it was shipped to ELK, but by the actual event of the log entry. How can I achieve this?

2

does no one really know how to do this?

3

You are extracting the timestamp from the log message into [syslog_timestamp], but using the date filter to parse a different field. Parse the [syslog_timestamp].

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.