How can I check if the log file path contains a certain string in the logstash configuration using regex?

Elastic Stack Logstash
1

I use filebeat to send logs to logstash, based on their file names - these logs are sent to specific indexes in elasticsearch. Filebeat works fine, logstash receives log files, but I can't get the regular expression in my logstash configuration to check if the filenames contain a certain work string.

input {
beats {
  port => 5044
 }
}
 filter {
 csv {
   separator => ","
    columns => ["Order ID","Status","Remarks"]
}
 }
     output {
   if [source] =~ "/path/to/my/logs/log-file-1*.csv" {
    stdout {}
     }
   else if [source] =~ "/path/to/my/logs/log-file-2*.csv" {
    stdout {}
    }
  else if [source] =~ "/path/to/my/logs/log-file-3*.csv" {
   stdout {}
   }
  else if [source] =~ "/path/to/my/logs/log-file-4*.csv" {
   stdout {}
   }  
   }

Am I referencing [source] the right way?

2

Can you post here a sample of a document output by logstash?

3

Does it work better if you try

if [source] =~ /\/path\/to\/my\/logs\/log-file-1.*\.csv/
4

How's my previous answer (which actually is a question) supposed to be a solution to your problem? :man_shrugging:

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.