Exception Handling

Elastic Stack Logstash
1

Hi all !!!!

I'm using this filter:

date {
match => ["My field","dd-MM-YYYY HH.mm.ss","ISO8601"]
target => ["My field"]
}

I would like handle the runtime exception that can occur.

For example a code structure like this:

try
{
// my filter
}
catch()
{
// exception handling ==> write new message in file or dedicated elasticsearch index

}

I found this topic:
https://logstash.jira.com/browse/LOGSTASH-1375

but unfortunately, this solution does not seem to work.

Any suggestions?

Regards,
Matteo

2

If the date parsing fails the message will by default get the tag _dateparsefailure so you can do something like this:

filter {
  date {
    ...
  }
}

output {
  if "_dateparsefailure" in [tags] {
    file {
      path => ".../date_parse_errors.log"
    }
  }
}
2 Likes