Hello, i have some problem with grok.
my_config.conf:
input {
stdin {}
}
filter {
grok { }
}
output {
stdout { codec => rubydebug }
}
but grok doesn't work.
logs:
Sending Logstash's logs to /home/em/Downloads/logstash-5.4.0/logs which is now configured via log4j2.properties
[2017-05-13T16:16:18,507][INFO ][logstash.pipeline ] Starting pipeline {"id"=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>500}
[2017-05-13T16:16:18,528][INFO ][logstash.pipeline ] Pipeline main started
The stdin plugin is now waiting for input:
[2017-05-13T16:16:18,564][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
z
{
"@timestamp" => 2017-05-13T13:16:22.713Z,
"@version" => "1",
"host" => "em-MS-7971",
"message" => "z",
"tags" => [
[0] "_grokparsefailure"
]
}
Constantly produces a tag "_grokparsefailure"
Because of what it could happen?