Hello
I have several beats entries on my logstash, but the logs I process are different, so I would like to do a grok by beat.
example log lines :
2017/07/27 18:02:37 VCS ERROR V-16-1-54031 Resource XXXXXXXXX(Owner: Unspecified, Group: XXXXXXXXX) is FAULTED on sys rsxl010101
for this log, i have this grok :
match => { "message" => "%{DATESTAMP:mytimestamp} %{WORD:tp} %{LOGLEVEL:logLevel} %{GREEDYDATA:logMessage}" }
that's ok. It can work on %{LOGLEVEL:logLevel} in kibana with filters.
But filebeat catch another file with this line :
02/11/2021 03:21:54 ANS0361I DIAG: sessSendVerb: Error sending Verb, rc: -50
My previous grok don't understand that "ANS0361I" is an %{WORD:tp}
I can't make filters on tp is ANS0361I
Do you have any advices ?