Grok filter help

Elastic Stack Logstash
1

I am seeing this error in my logstash log

at [Source: [B@1717bb35; line: 1, column: 2]>, :level=>:warn}
{:timestamp=>"2016-03-09T02:07:34.248000+0000", :message=>"Error parsing json", :source=>"message", :raw=>"<182>Mar 8 18:07:34 IRV3-INPROD-LB1 info logger: [ssl_acc] 10.45.214.89 - od9655 [08/Mar/2016:18:07:34 -0800] "/xui/update/configuration/alert/statusmenu/coloradvisory" 200 1194\n", :exception=>#<LogStash::Json::ParserError: Unexpected character ('<' (code 60)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')

This is what is coming in

Tue Mar 8 16:42:17 PST 2016 notice IRV3-INPROD-LB1 mcpd[6503] 01070727 Pool /Common/learch_8080 member /Common/10.1.10.197:8080 monitor status
up. [ /Common/GET_HEALTHTXT: up ] [ was down for 0hr:1min:24sec ]

I am trying to match following log coming in from F5 load balancer

2

You are attempting to parse a syslog message with a json filter or codec. Don't do that. More specific help requires that you show your configuration.

3

Here is the snippet. I think it's because of that json filter that I am using to capture other events.

input {
tcp {
port => 5001
type => "lwes"
}
udp {
host => "0.0.0.0"
port => 5544
type => "f5-logs"

   }

  }

filter {
json {
source => "message"
}

alter {
remove_field => "message"
}

geoip {
source => "RequesterIP"
}
metrics {
meter => "events"
add_tag => "metric"
}

if [type] == "f5-logs" {
    grok {
      break_on_match => false
      match => { "message" =>  "\A%{SYSLOGTIMESTAMP}%{HOSTNAME}%{LOGLEVEL}%{SYSLOGPROG}:%{GREEDYDATA}"  }
      add_tag => "grokked_syslog_f5"
    }
4

Yes. So use a conditional (similar to the one for your grok filter) to only apply the json filter selectively.

5

Thanks for the tip, I have it working