Hello everyone.
I wrote grok pattern, checked it in debugger in Kibana.
Grok pattern OK in debugger, but in logstash i got parse failure.
I tried to debug pattern in logstash with
~/logstash/bin/logstash --path.settings=~/logstash/config -f ~/logstash/config/test.conf --log.level=debug --config.debug > ~/debug.txt
but can't find related output in file ~/debug.txt and/or stdout
Please, tell me what I'm doing wrong?
inside my config:
input {
file {
path => "/home/me/test.txt"
sincedb_path => "/home/me/tmp"
start_position => "beginning"
}
}
filter {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:time}%{GREEDYDATA}%{SPACE}Execute%{SPACE}%{WORD:execute}\([channel\(\\"%{WORD:channel}%{GREEDYDATA:test28}" }
}
}
output {
stdout { codec => rubydebug }
file {
codec => "plain"
path => "/home/me/log.txt"
}
}
Hi
Can you provide a sample of your input? You could comment out your entire filter{} section and see what you get at stdout{}.
Hope this helps.
I'm tried to find out something helpful in debug output for 2 hours, and when I escaped everything with right number of slashes of one, debug output lost two lines which l can't to connect with my problem. But finally I got it. Logstash debug will never helps me.
Thank you for everything.
I'm find out solution in wrong number of slashes escaping special characters in my pattern.