Hi I am trying to fetch the testnames from a multiline logfile using logstash.
Below is the sample:
testname1.sh
DH no
TIMESTAMP 1454774186
LASTSTATION xxx
LASTPASS 1454774186
PASSNUM 1500
PASSSTATION xxx
TESTDURATION 286
TIMESRUN 1500
STATUS PASSED
testname2.sh
TIMESTAMP 1454775151
LASTSTATION xxx
LASTPASS 1454775151
PASSNUM 1498
PASSSTATION xxx
TESTDURATION 229
TIMESRUN 1498
STATUS PASSED
testname3.sh
DH no
PRIORITY HIGH
LASTPASS 1454567890
PASSNUM 1483
PASSSTATION xxx
TESTDURATION 33796
TIMESRUN 1483
TIMESTAMP 1454771355
STATUS RUNNING
LASTSTATION yyy
I need to extract testname1.sh, testnam2.sh and testname3.sh and index it into 1 document in Elasticsearch
I tried different patterns , but nothing seems to be working
Few things i tried
grok
{
match => [
"message", "%{GREEDYDATA:testname}.sh"
]
}
Also, I tried usng multiline filter to read compelte file with the below pattern
multiline {
pattern => "/.*./gm"
negate => true
what => "previous"
}
and tried to use the .sh string, but did not work
COuld someone please help me out on how to retrieve the testnames from the above sample?