Basic Configuration File

Elastic Stack Logstash
1

Hello,

I have the following code as a test configuration file.

input {
file {
path => "C:\Users\Admin\Desktop\Logs_elasticsearch\test_10142015.txt"
}
}

filter {
grok {
patterns_dir => "C:\Program Files\logstash-1.5.3\patterns"
match => {"message" => "%{XYZ:time} %{GREEDYDATA:MESSAGE}"}
}
}

output {
elasticsearch {
host => localhost
protocol => "http"
}
stdout { codec => rubydebug }
}

Our pattern file has the following definition: XYZ %{MONTH} %{MONTHDAY}, %{YEAR} %{TIME} (?:AM|am|PM|pm)

I got the following error lines while running the configuration file which I believe can be safely ignored:

C:\Program Files\logstash-1.5.3\bin>logstash.bat -f test.conf
io/console not supported; tty will not be manipulated
'[DEPRECATED] use require 'concurrent' instead of require 'concurrent_ruby'
Logstash startup completed

  1. If required, can someone point out any mistake that we may have?
  2. Also, I would like to validate on JSense (on a browser) if the parsing is being done as expected and that my code is working. What would be the exact command that I should be using?
2

At first glance it looks ok.

But what do you mean validate in your browser? LS has nothing to do with browsers.

3

Hi Mark,

Thanks for your quick response. What I mean by "validate in my browser" is that I would like to test that my parsing that I coded in the configuration file is working as expected. I believed that it is possible to use a tool (such as JSsense) that uses a browser as an interface to run the commands.

Else, I would not mind running the commands soly on command line.

Thanks for your assistance

4

I was looking for some assistance as we were not able to output the labels using a curl command after we ran the configuration file shown above.

Can someone show us how we would test this part of the code.

Regards

5

I'm a little lost here, you don't use curl with this.
Can you be a little more explicit with what you are doing, including what commands you are running.