Create a global patterns_dir

Elastic Stack Logstash
1

Hello,

Is it possible to define a global patterns_dir for all cases in filter or it must be defined in each grok section.

Se below:

   if ("xxx" in [path])  {
      grok {
        **patterns_dir => [ "/usr/share/logstash/patterns" ]**
        match => { "message" => "^%{TIMESTAMP_ISO8601:timestamp}\;%{LOGLEVEL:loglevel}(.*);%{OPTIONALUSERNAME:user};%{TNR:tnr};%{INTEGRATION:integration};%{THREAD:thread};%{WORD:classname};%{GREEDYDATA:logmessage}$" }
        add_field => [ "logtype", "xxx" ]
      }
    }
    if ("yyy" in [path])  {
      grok {
        **patterns_dir => [ "/usr/share/logstash/patterns" ]**
        match => { "message" => "^%{TIMESTAMP_ISO8601:timestamp}\;%{LOGLEVEL:loglevel}(.*);%{OPTIONALUSERNAME:user};%{TNR:tnr};%{INTEGRATION:integration};%{THREAD:thread};%{WORD:classname};%{GREEDYDATA:logmessage}$" }
        add_field => [ "logtype", "yyy" ]
      }
    }
2

You'll have to define it everywhere.

In this case I don't understand why you have two grok filters.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.