GROK not able to read errors

Elastic Stack Logstash
1

I amusing the following grok in my logstash config

filter{
grok{
match => { "message" => [ "%{TIMESTAMP_ISO8601:log_date} [%{NOTSPACE:thread}] %{LOGLEVEL:log_level} %{NOTSPACE:classname} - EventID:%{NOTSPACE:eventID},Status:%{WORD:status}", "%{TIMESTAMP_ISO8601:log_date} [%{NOTSPACE:thread}] %{LOGLEVEL:log_level} %{GREEDYDATA:msg}" ] }
add_tag => [ "%{eventID}" ]
add_tag => [ "%{status}" ]
}

  if "ERROR" not in [log_level] {
  if ",Status:" not in [message] {
       drop { }
  	  }
}

  date{
      match => ["log_date","ISO8601"]
  }
 }

I am getting the pattern above matched successfully and published to elk. The second part %{TIMESTAMP_ISO8601:log_date} [%{NOTSPACE:thread}] %{LOGLEVEL:log_level} %{GREEDYDATA:msg}

matches the error published. i have validated the same in GROK debugger. But i am not able to see any ERROR logs in the published index.

2

Thanks I resolved the issue.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.