Hi,
I have a logstash filter as below.
input {
file {
path => "/home/testserver/Downloads/log_source/logs/*/**"
start_position => "beginning"
sincedb_path => "/dev/null"
type => "test-logs"
}
}
filter
{
if [type] == "kernel-logs" {
grok {
match => {"message" => "%{TIMESTAMP_ISO8601: timestamp} %{LOGLEVEL:severity} %{DATA:logtype} (?:[%{DATA:syslog_pid}])? %{GREEDYDATA: kernel_log}"}
}
date {
match => ["timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}
output {
if [severity] == "ERR" {
stdout {
codec => "rubydebug"
}
}
}
In my Kibana dashboard, I am getting only the err logs and it works fine.
In kibana dashboard the message comes as below.
"{
"severity" => "ERR",
"path" => "/home/testserver/Downloads/log_source/logs/sys-1/messages.6",
"logtype" => "kernel:",
"@timestamp" => 2017-07-10T23:59:44.437Z,
"syslog_pid" => "100812.570395",
"@version" => "1",
"host" => "testserver1",
"message" => "2017-06-29T16:27:48.401397-07:00 ERR kernel: [100812.570395] i2c_designware i2c_designware.2 (7bit mode)",
"type" => "kernel-logs"
}
"
What I am trying to do is: the "path" should be displayed as a file:// link or a ftp link instead of "/home/testserver/Downloads/log_source/logs/sys-1/messages.6" so that users can click on it in kibana dashboard and view it in their browser.
Is there any way I can achieve this ?