Handle filter exception in Logstash

Elastic Stack Logstash
1

Hello elasticusers,

I have a question about exceptions in the filter part of Logstash.

This is my config file (I don't describe the "intput" and "output" parts) :

input {
    file{}
}
filter {
    csv { ...}
    grok {...}
    date{...}
   ruby{...}
}
output {
    elasticsearch {}
}

Is it possible to handle exceptions generated by filters (csv, ruby...)?

I can apply a statement like this :

if "_csvparsefailure" in [tags] {
...
}

But I want to extract the exception message in this case, for example :
_":exception=>#<CSV::MalformedCSVError: Illegal quoting in line 1.>".

Is it possible to catch this exception message in order to output it to the file?

output {
    file {
        path => "/path_to_my_file/filter_error.log"
	codec => line {
	    format => "%{message} | %{exception_filter_expected}"
	}
    }
}

Used version : Logstash 6.3.0

Thank you in advance for your help.

2

I think you can handle it in the ruby filter (with the ruby exception mechanism) but for the other ones, I have no idea (except rewrite them with the ruby filter).

3

Do you think is it possible to handle exceptions from other filters (csc,grok,...) in ruby filter?

4

No I don't ... :grimacing:

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.