Availiable actions for _grokparsefailure (drop, mutate, ...) - need _grokparsefailure events in a separate file

For further analysis I need only _grokparsefailure events in a separate file.
I thought instead of "drop" I could use "file" (like in the output section) but it doesnt work.
How can I do that or where can I find more information and explanationd about options for "_grokparsefailure"?

Kind regards

You can make the output conditional.

Something like

output {
    if "_grokparsefailure" in [tags] {
         file {
    } else {
        ...some other output...

Looks good. That's my conditional output.
Now I need to wait until tomorrow :wink:

  else if [type] == "syslogdect500" {
    if "_grokparsefailure" in [tags] {
        file {"path" => "/tmp/gork_dect500_failure.txt"}
    else {
        elasticsearch {
        hosts => ["*****:9200"]
        user => "*****"
        password => "*****"
        index => "syslogdect500-%{+YYYY.MM}"
        #stdout { codec => rubydebug }

Kind regrads

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.