Grok - every fields is putted into message

Elastic Stack Logstash
1

hi all,
I'm sending messages from Filebeat to Logstash where I will used Grok to parse correctly and then send to Elastic.
The first step, from FB to LS works correctly.
unfortunately, when I try to apply Grok I got all the fields directly into message field.

here my logstash.conf:

input { 
	beats {
      		port => 5045
	}
}

filter {
 if [message] =~ "^#" {
  drop {}
 }
 grok {
        break_on_match => false
        match => [
            "message", ".*calling addr\=\\"%{IPV4:client}\/%{INT:client port}\\".*called_addr\=\\"%{IPV4:server}\/%{INT:server port}\\".*login\=\\"%{USERNAME:username}\\"",
			"message", ".*Connection Failure, reason :\s*%{GREEDYDATA:message}",
            "message", ".*CGate\s*%{GREEDYDATA:message}"
        ]
    }
}

output {
 if [CrifBeats] == "ft_audit"{
  elasticsearch { 		
   hosts => ["localhost:9200"]
   index => "ftaudit-%{+YYYY.MM.dd}"
  }
 }
}

using grok debugger at http://grokdebug.herokuapp.com/ it works correctly but when message is parsed in my LS I get everything into message field.
I was sure that grok should be able to create/add indicated fields.
I know that I'm doing something wrong but I cannot understand where.

2

Does specifying the overwrite parameter help?

3

The issue was due to the used regex. Basically, it was not matched so new fields were not created

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.