Grok on logstash not working, but working on grokdebugger

Elastic Stack Logstash
1

Hello,
The following grok pattern is working on grokdebugger perfectly.

%{DATESTAMP:Timestamp} %{LOGLEVEL:LogLevel} [%{JAVACLASS:Class}] (%{GREEDYDATA:MessageID}) %{GREEDYDATA:Error}\n(?m)%{GREEDYDATA:JavaStackTrace}

image
image.png1366×768 86.3 KB

This is precisely the response I want.

Now, when I run the same pattern in logstash, I get an incorrect output.

image
image.png1366×768 73 KB

both are using a multiline pattern "^\s"

Can someone please tell me why?

This is my config file.

input {

beats {
type => "syserr"
port => "5044"
codec => multiline {
pattern => "^\s"
what => "previous"
}
}
}

filter {

if [type] =="syserr"{
    grok {
         
         match => ["message", "%{DATESTAMP:Timestamp} %{LOGLEVEL:LogLevel} \[%{JAVACLASS:Class}\] \(%{GREEDYDATA:MessageID}\) %{GREEDYDATA:Error}\n(?m)%{GREEDYDATA:JavaStackTrace}"]
         overwrite => [ "message" ]
        
         
         }

}

}

output {
elasticsearch {
hosts => [ "localhost:9200" ]
}

stdout {
    codec => "rubydebug"
}

}

indent preformatted text by 4 spaces
2

I have negate => "true" in the grok debugger. But adding this statement to my logstash config causes a _grokparsefailure.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.