Hello, I am trying to define several patterns to use on logstash.conf.
So far I have tried this:
grok{
tag_on_failure => []
pattern_definitions => {"text1" => "((?<=responses=)[a-zA-z ]+(?=,))"}
pattern_definions => {"text2"=> "([,][ ][a-zA-z ?]+)"}
match => {"message" => "%{text1:response_text}"}
}
This one makes logstash stop with exit code 1
and this:
pattern_definitions => {["text1" => "((?<=responses=)[a-zA-z ]+(?=,))", "text2" => "([,][ ][a-zA-z ?]+)"]}
This one makes logstash stop with exit code 0
What is the proper syntax for this? I can't find anything in the documentation. The closest I found was this:
But all of that refers to using REST endpoints. I am using a logstash.conf file