I want to know what is the best way to handle multiple logs pattern single file. I have created below filter for the my logs. filter { if[type] =='AppLog' { grok { break_on_match => false match => { "message" => [ "%{TIMESTAMP_ISO8601:LogDate} %{LOGLEVEL:loglevel} (?<threadName>[^:]+):(?<Lin…

I have marked break_on_match as false, it goes through both pattern But that's not what you want to do. You want it to try two patterns and be satisfied with the first match. The first expression could match if the log message looks like JSON and begins and ends with braces, i.e. your two express…

Discuss the Elastic Stack

How to handle multiple match in logstash filter

Elastic Stack Logstash

ankeet.jain (Ankit) August 10, 2017, 5:02pm 3

I have just edited my question. It was incomplete.

Topic		Replies	Views
GROK Multiple Match - Logstash Logstash	4	27162	July 6, 2017
Want to match against single grok pattern and multiple patterns in same filter Logstash	1	281	September 23, 2020
Logstash parsing each log multiple times Logstash	5	1294	September 25, 2018
How to parse single log file with multiple grok pattern Logstash	4	3099	June 1, 2017
Multiple pattern matching log file Logstash	3	1083	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

How to handle multiple match in logstash filter

Related topics