How to handle case when the INDEX value is not included in the "path" value?

[chunji08 (chun ji)]

Hi All,
Our system is used by multiple users every day to submit different jobs. And when one job is being processed, we would like to have logsatsh to do a real-time analysis if some log message is raised. And if it does, we would have such log message indexed per the current job-id.

As you can see the sample I put at the buttom. This is type of message the "Indexer Logstash" is given, where the "path" does not carry the job-id value. The actual value is kept in a property file. I have followed this link,
"

How to read the file from linux machine in logstash

For reading the file from window machine I am using the following input filter and able to read the file from remote machine and writing to elasticsearch similarly I want to read the file from linux machine. input { file { type => "appname" path => "\IP Address/path/csvresultfolder/*.csv" start_position => "beginning" sincedb_path => "/dev/null" } } Can we refer the hostname specified in properties file in logstash file,Please let me know.for example properties file name is user.prop…

",
to have the value set in my env, and have the shipper.conf read. And that is why you see the "tag" is giving the unique job-id (36293300) now.
"
{
"path" => "/user/logs/work/TOP/SFO/aaa/bbb/logs/server.out",
"message" => " my log messages here ..."
"type" => "sjc",
"tags" => [
[0] "36293300"
]
}
",

So overall, this problem has been solved and this news group is very helpful for us.

Thanks a lot for the help.

CJ