In logstash, we were trying to parse a sample log using custom grok pattern.
The sample log looks like:
2017.09.26 00:59:47:158 UTC | Info | Sip | UserProfileNonCall [Thread #231] | +7777777777 | callhalf-10000000000
We have tried to match the input logs with following logstash configuration:
input {
file {
path => "/var/log/samplelog.txt"
start_position => "beginning"
codec => multiline {
pattern => "^(?[0-9]+.[0-9]+.[0-9]+)"
negate => true
what => "previous"
}
}
}
filter {
grok {
match => [ "message" , "(?[0-9]+.[0-9]+.[0-9]+)" ]
}
}
output {
elasticsearch {
hosts => [ "localhost:9200" ]
}
stdout { codec => rubydebug }
}
We have tried with multiline codec. The above mentioned configuration is not giving any error message in logstash.log file. But we are not able to see the logs in kibana.
Have tried different combinations of custom grok pattern for matching the log but its not working. So can you please provide the solution for this?