How to apply different filters based on particular name of files without using Filebeat

Elastic Stack Logstash
4

With [path] set to "/home/joseph/logs/1.log" that grok works just fine for me. However, I would write it differently. There is no need for the initial %{GREEDYDATA} since the pattern is not anchored to the start of the field. Also, I would anchor it to the end of the field. Also, \w is already a character class, so there is no need for [ and ] around it.

    grok {
        match => { "path" => "%{SYSID:sysid}\.log$" }
        pattern_definitions => { "SYSID" => "\w{1}" }
    }

But regardless of the stylistic points, your grok works just fine for me, so I am not sure what the issue is.