GROK not able to read errors

I amusing the following grok in my logstash config

match => { "message" => [ "%{TIMESTAMP_ISO8601:log_date} [%{NOTSPACE:thread}] %{LOGLEVEL:log_level} %{NOTSPACE:classname} - EventID:%{NOTSPACE:eventID},Status:%{WORD:status}", "%{TIMESTAMP_ISO8601:log_date} [%{NOTSPACE:thread}] %{LOGLEVEL:log_level} %{GREEDYDATA:msg}" ] }
add_tag => [ "%{eventID}" ]
add_tag => [ "%{status}" ]

  if "ERROR" not in [log_level] {
  if ",Status:" not in [message] {
       drop { }

      match => ["log_date","ISO8601"]

I am getting the pattern above matched successfully and published to elk. The second part %{TIMESTAMP_ISO8601:log_date} [%{NOTSPACE:thread}] %{LOGLEVEL:log_level} %{GREEDYDATA:msg}

matches the error published. i have validated the same in GROK debugger. But i am not able to see any ERROR logs in the published index.

Thanks I resolved the issue.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.