How to filter out certain lines from log file in logstash


(Subbu v) #1

Hi,

i am current have a log file with following lines

***** TESTINGG Finished
Start Time: 02:05:33 Oct 11 2015 Temp: 46 C: 46 C: 43 C: 40 C: 40 C: 53 C: 59 C
End Time: 01:35:45 Oct 13 2015 Temp: 52 C: 49 C: 49 C: 41 C: 41 C: 55 C: 62 C
Total Test Time: 01 days:23 hrs:30 min:12 sec
Total Cycles: 1 cycles
RUNIN Test FAILED
FILE_PATH:/opt/web/test/abc/

i need to take out the FILE_PATH and add it into a separate field. can some one help me in doing this?

currently using below tag that puts the complete line in a message.

grok {
match => { "message" => "%{COMBINEDAPACHELOG}"}
}


(Magnus B├Ąck) #2

Um, COMBINEDAPACHELOG is for Apache logs and this isn't an Apache log. But you should use the grok filter:

grok {
  match => { "message" => "^FILE_PATH:%{GREEDYDATA:filepath}" }
}

(Subbu v) #3

thanks a lot. it works


(system) #4