Dear Team
I have following grok filter which matches 2 different fields from CSV file . However I have noticed that Logstash ignores the second line ( excuses) when sending the traffic to Elasticsearch . In case where the IP is not present in the CSV then the second filter works . As a work around I have created two separate grok filters and every thing works as expected .
I was wondering if there any issue with my filter sentence where both filters not working on one grok filter or it is a expected behaviour ?
grok {
match => ["ip:port", "%?/%{IP:src_ip}?:%{NUMBER:src_port}"],
match => ["excuses", "%{WORD:excuses_type_letter}=%{NUMBER:excuses_type_value}"]
}
Work Around
grok {
match => ["ip:port", "%?/%{IP:src_ip}?:%{NUMBER:src_port}"]
}
grok {
match => ["excuses", "%{WORD:excuses_type_letter}=%{NUMBER:excuses_type_value}"
]
}