Config logstash display grok pattern

[iceman0410 (Jason)]

Hi everyone,

I am trying to config logstash.conf to display 3 patterns: Date time, Log Level and Message but it does not display patterns. Here is my logstash config file. Please help me check correct if any thing wrong.

input {
beats {
port => 5044
}
}

filter
{
if [tag] == "ctmcli_ccm_diag_nlog"
{
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:dts}%{SPACE}%{LOGLEVEL:lvl}%{GREEDYDATA:rest}" }
}
date
{
match => ["dts", "yyyy-MM-dd HH:mm:ss,SSSS"]
target => "@timestamp"
timezone => "UTC"
}
}
}
output {
stdout {
codec => rubydebug
}
}
Thanks everyone

[yago82]

@iceman0410

Hi everyone,

I am trying to config logstash.conf to display 3 patterns: Date time, Log Level and Message but it does not display patterns. Here is my logstash config file. Please help me check correct if any thing wrong.

input {
beats {
port => 5044
}
}

filter
{
if [tag] == "ctmcli_ccm_diag_nlog"
{
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:dts}%{SPACE}%{LOGLEVEL:lvl}%{GREEDYDATA:rest}" }
}
date
{
match => ["dts", "yyyy-MM-dd HH:mm:ss,SSSS"]
target => "@timestamp"
timezone => "UTC"
}
}
}
output {
stdout {
codec => rubydebug
}
}
Thanks everyone

Hi,

You're applying the grok filter and date filter only to events where the tag field is equal to "ctmcli_ccm_diag_nlog". Make sure your events actually have this tag. If not, the filters won't be applied.

Then you have to check the Logstash logs for any error or warning messages. If there's a problem with your configuration, it's likely that Logstash will log a message about it.

Regards