Grok pattern doesn't match path

Elastic Stack Logstash
1

Hi,

I have a problem that I cannot solve for too long so I'm using this forum to get a help :slight_smile:
i need to to get name of application server parsed from path.
I have this simple pattern but i'm getting "_grokparsefailure" in tags

input {
    beats {
        port => "5044"
    }
}
filter {
    if "app-server" in [tags] {
        grok {
        # match app server from log path
            match => {"path" => "%{GREEDYDATA}/logs/%{DATA:app_server_name}/SystemOut.log"}
         }
    }
}
output {
      stdout { codec => rubydebug }
 }

the output i'm getting is this

{
         "input" => {
        "type" => "log"
    },
           "log" => {
        "offset" => 690955,
          "file" => {
            "path" => "/opt/IBM/WebSphere/AppServer/profiles/pillipercol/logs/server2/SystemOut.log"
        }
    },
          "tags" => [
        [0] "app-server",
        [1] "beats_input_codec_plain_applied",
        [2] "_grokparsefailure"
    ],
    "@timestamp" => 2020-02-10T12:53:07.774Z,
       "message" => "[2/10/20 13:53:01:439 CET] 000025c6 CacheSlotCmdI I com.commerce.order.commands.CacheSlotCmdImpl performExecute Exiting",
      "@version" => "1",
           "ecs" => {
        "version" => "1.0.0"
    },
          "host" => {
        "name" => "*************"
    },
         "agent" => {
            "hostname" => "**************",
                  "id" => "751b53a2-0c35-4b94-ae76-4f43981a9d8a",
        "ephemeral_id" => "9010e020-41bf-4d97-8842-bda1624c6a73",
             "version" => "7.0.1",
                "type" => "filebeat"
    }
}
2

What about applying that grok to [file][path] rather than simply [path]? So

input {
  beats {
    port => "5044"
  }
}

filter {
  if "app-server" in [tags] {
    grok {
    # match app server from log path
      match => {"[file][path]" => "%{GREEDYDATA}/logs/%{DATA:app_server_name}/SystemOut.log"}
    }
  }
}

output {
  stdout {}
}
3

Thanks for quick reponse but unfortunatelly this didn't help.
i updated Logstash to 7.5.2.
Bus still the app_server_name field is not getting parsed :confused:

4

It's actually [log][file][path]

5

Ooops...didn't see the external [log] because of the weird indentation. As Badger says, with [log][file][path] it should work

6

thx a lot :slight_smile:
worked

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.