Grok filter: check if field exists

(Alessio Frabotta) #1

I have a log message with this structure:

"message" => "{    
    "message":"JNA not found. native methods will be disabled.",
    "stack_trace": "java.lang.ClassNotFoundException: ... 

As you can see, inside the message there is a stack_trace field, but the control

if [message][stack_trace] {
	mutate { add_tag => ["EXCEPTION"] }

doesn't work

How can I check if "message" contains the "stack_trace" field?


Did you parse message with a json filter or codec?

(Alessio Frabotta) #3

the message is generated via logstash-logback-encoder, as follow:

<appender name="STASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">

	<encoder class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
			<loggerName />
			<logLevel />
			<message />
			<stackTrace />

This is the content of logstash input pipeline:

input {
	tcp {
    	port => 5000

filter {

output {


This is the correct syntax, although if I parse that input with an xml filter the field would end up being called [message][providers][stackTrace] (or [message][providers][0][stackTrace][0] without force_array => false).

(Alessio Frabotta) #5


I added

json {
	source => "message"

and now the instruction

if [message][stack_trace] { }

works !

Sorry, but slowly I'm trying to understand logstash

(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.