Hi all,
I'm using logstash 2.3 elasticsearch 2.3
I use filter-plugin-elasticsearch to query previous event
This is file log:
2016-04-26 16:30:00 userA in
2016-04-26 16:35:00 userA out
This is file config:
input{
file{
path =>"/opt/file1.log"
}
}
filter{
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{USERNAME:username} %{WORD:status}"}
}
if [status] == "in" {
mutate {
rename => {"timestamp" => "started"}
}
date {
match =>["started","yyyy-MM-dd HH:mm:ss"]
target => "[started]"
}
}
if [status] == out{
elasticsearch {
hosts => ["localhost"]
query => "status:in AND username:%{[username]}"
fields => ["@timestamp","started"]
}
}
ruby {
init => "require 'time'"
code => "event['duration_hrs'] = Time.parse((event['ended']).to_s).iso8601 - Time.parse((event['started']).to_s).iso8601"
add_tag => ["duration_hrs"]
}
}
output {
stdout { codec => rubydebug}
if "_grokparsefailure" not in [tags] {
elasticsearch { hosts => ["localhost:9200"]
index => "index-%{+YYYY.MM.dd}"}
}
}
Error:
Failed to query elasticsearch for previous event {:query=>"status:in AND username:userA}", :event=>#"/opt/file1.log"}, @lut={"[path]"=>[{"path"=>"/opt/file1.log"}, "path"]}>, @cancelled=false, @data={"message"=>"", "@version"=>"1", "@timestamp"=>"2016-04-26T02:55:43.702Z", "path"=>"/opt/file1.log", "host"=>"elk.test.vn", "tags"=>["_grokparsefailure"]}, @metadata={"path"=>"/opt/file1.log"}, @accessors=#"", "@version"=>"1", "@timestamp"=>"2016-04-26T02:55:43.702Z", "path"=>"/opt/file1.log", "host"=>"