Greetings All,
I am new to ELK and stumbled all day yesterday trying to filter out logs that met a certain condition. Any insight as to how I should approach this is much appreciated.
**Failed attempt #1
input {
beats {
port => 5044
}
}
filter {
grok {
match => { "message" => "%{SYSLOGBASE2}" }
}
# Match type and level.
# Drop warning events
if [logsource] == "WARN" {
drop { }
}
# Drop information events
if [logsource] == "INFO" {
drop { }
}
}
output {
elasticsearch {
hosts => "elasticsearch1:9200"
user => "elastic"
password => "blah"
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
**Failed attempt #2
input {
beats {
port => 5044
}
}
filter {
grok {
match => { "message" => "%{SYSLOGBASE2}" }
}
output {
stdout {
codec => rubydebug
}
if [logsource] != "WARN" or "INFO" {
elasticsearch {
hosts => "elasticsearch1:9200"
user => "elastic"
password => "changeme"
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
}
**ES record
{
"_index": "filebeat-2018.08.01",
"_type": "log",
"_id": "AWT2khPHLvjxV3lis6j4",
"_version": 1,
"_score": null,
"_source": {
"offset": 3403880,
"input_type": "log",
"timestamp8601": "2018-08-01 17:38:45.178",
"source": "/local/mnt/logs/filebeat/apps/solr/solr-cpip-filebox.log",
"message": "2018-08-01 17:38:45.178 INFO (qtp401424608-19) [ x:cpip-filebox] o.a.s.u.p.LogUpdateProcessorFactory [cpip-filebox] webapp=/solr-cpip-filebox path=/update params={waitSearcher=true&commit=true&softCommit=false&wt=javabin&version=2}{commit=} 0 1",
"type": "log",
"logsource": "INFO",
"tags": [
"beats_input_codec_plain_applied"
],
"environment": "tst",
"logtype": "application_log",
"@timestamp": "2018-08-01T17:38:45.290Z",
"@version": "1",
"beat": {
"name": "vdpsidxtst05",
"hostname": "vdpsidxtst05",
"version": "5.5.0"
},
"host": "vdpsidxtst05"
},
"fields": {
"@timestamp": [
1533145125290
]
},
"sort": [
1533145125290
]
}