How to define patterns_dir as global in logstash...?

Elastic Stack Logstash
1

Hi,
I have a pattens file which contains diffrent patterns as line by line. I am matching each pattern as follows.

 if [tran_type_cd] in ["EMD","EMA","EMC","EMF","EMU","EMX"] {  
        	grok {patterns_dir   => ["logstash-7.0.0/schemas/nonrtd/patterns"]
              	  match => { "message" => "%{EMD}" }}}

          else if [tran_type_cd] in ["ISG","IPV"]{
          	grok {patterns_dir   => ["logstash-7.0.0/schemas/nonrtd/patterns"]
                 match => { "message" => "%{ISG}" }}}

          else if [tran_type_cd] in ["IEN","IER","MEN","MER","TEN"]{
                grok {patterns_dir   => ["logstash-7.0.0/schemas/nonrtd/patterns"]
                 match => { "message" => "%{IEN}" }}}

          else if [tran_type_cd] == "IPU"{
                grok {patterns_dir   => ["logstash-7.0.0/schemas/nonrtd/patterns"]
                 match => { "message" => "%{IPU}" }}}

I am loading patterns_dir for each else conditions. How can I define patterns_dir as global and match pattern directly. this could avoid defining patterns_dir for each else if conditions.

thanks for reading and hellping.

2

You can define multiple grok patterns in a single match :slight_smile:

grok {
    patterns_dir   => ["logstash-7.0.0/schemas/nonrtd/patterns"]
    match => { "message" => [ "%{EMD}", 
                              "%{ISG}", 
                              "%{IEN}", 
                              "%{IPU}" ]
    }
1 Like
3

This is useful ,but I also need to check if condition based on variable "trans_type_cd" before matching.

thanks for reading and helping.

4

Why do you need to check for that field before matching? Why not after?

5

if value of transa_type_cd is diffrent ,then I need to match message with diffrent pattern. where should I put the if else if conditions as per your solution ..

thanks for reading and helping

6

No, you do not. You can give the grok filter a list of patterns and it will match against whichever one works. Unless they are ambiguous it will do the if-else if-else if for you.

1 Like
7

That is cool. will check it out.

thanks or reading and helping

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.