Cannot receive data after using grok

Elastic Stack Logstash
1

Dear all,

The following is my logstash config. However, I find cannot receive data. I use netstat -an find the port of 5044 and 514 are not listening. If i remove grok, can receive data. Any idea? Thanks

input{
beats {
port => 5044
tags => "winlog"
}
syslog{
port => 514
tags => "syslog"
}
}

filter{
if "Imperva Inc" in [message]{
grok { match => ["message" => "(cs1=)(?[^"]+) (cs1Label=)"]}
}
}

output {
if "winlog" in [tags]{
elasticsearch {
hosts => ["localhost:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
else if "syslog" in [tags]{
elasticsearch {
hosts => ["localhost:9200"]
sniffing => true
manage_template => false
index => "syslog"
}
}

2

Have you looked in the Logstash logs for clues?

3

Hi Magnusbaeck,

Thanks for your reply, I find the problem. The reason is (cs1=)(?[^"]+) should be (cs1=)(?[^"]+)

Problem solved.

Thanks

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.