How are logstash grok definitions updated?

Elastic Stack Logstash
1

How do I find out what my current version of logstash core patterns are running on my logstash cluster? I am running 7.17.1, but I suspect I am not running grok core patterns 4.34 ecsv1. I would like to have access to some of the patterns in here. Obviously, I could just copy these patterns into my patterns folders myself, but is this always necessary or is there a way to keep up with these better?

Thanks for any help.

2

If you want to know what is installed I would suggest

find /usr/share/logstash -type d -name patterns

If it is not installed you would need to copy what patterns you want to your own folder or use the pattern_definitions option on the grok filter.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.