Grok filter for a custom message

Elastic Stack Logstash
1

**

The build ID of the run is : 104

**

I have the above line in the message field . I am trying to use Grok filter to extract the entire line to a new field by the name of "filteredValue".

WHat I have tried :

filter {
grok {
match => { "message =>%{{The build ID of the run is %{NUMBER}:filteredValue}}"}
}
}

Please let me know where exactly I am making the mistake. Thank you.

2

Try

grok { match => { "message" => "^The build ID of the run is : %{NUMBER:filteredValue}" } }
3

Thank you so much for the input. I am able to filter. However, I am not getting the entire line in the field - "filteredValue" . I am getting only the number i.e 104 in the above line.

Is there any way to get the entire line ? Thanks in advance.

4

If you want the entire event copied to a new field then I would suggest using a conditional to test that it is a line you care about and then using mutate+copy to copy message to some other field.

5

okay. Thank you. I will try and get back.

6

@Badger kindly give some input on this : Copy data from a field and make it available for all the documents

Thanks a lot.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.