Hi,
I'm trying to parse a two log files. Unfortunately, at Logstash output I've seen that only first log file (events.log) has been parsed and output do not contain any data from the second log-file algotw.log.
Please advise how to correctly parse more than one log file.
My logstash.conf is below:
input {
file {
path => ["C:\QUIK\Server\events.log"]
type => "QUIKServ-log"
codec => plain { charset => "UTF-8" }
start_position => "beginning"
sincedb_path => "C:\Progra~1\logstash\sincedb"
}
file {
path => ["C:\QUIK\AlgoTW\Import\algotw.log"]
type => "AlgoTW-log"
codec => plain { charset => "CP1251" }
start_position => "beginning"
sincedb_path => "C:\Progra~1\logstash\sincedb"
}
}
filter {
if [type] == "QUIKServ-log" and [message] !~ /Error|Exit|disconnect|reset by peer/ {
drop { }
}
mutate {
add_field => { "[@metadata][zabbix_key_quikserv]" => "quiksrv.lst" }
}
if [type] == "AlgoTW-log" and [message] !~ /Error|Critical/ {
drop { }
}
mutate {
add_field => { "[@metadata][zabbix_key_algotw]" => "algotw.lst" }
}
}
output {
if [type] == "QUIKServ-log" {
zabbix {
zabbix_host => "host"
zabbix_key => "[@metadata][zabbix_key_quikserv]"
zabbix_server_host => "10.1.110.71"
zabbix_value => "message"
}
}
if [type] == "AlgoTW-log" {
zabbix {
zabbix_host => "host"
zabbix_key => "[@metadata][zabbix_key_algotw]"
zabbix_server_host => "10.1.110.71"
zabbix_value => "message"
}
}
stdout { codec => rubydebug }
}
A small part of Logstash output is below:
{
"message" => "E: 10 Jun 15 (Wed) 07:05:17.837 (7912:6420:DWUSND): Running C:\\QUIK\\Server\\quik.exe: Error: User 50 already work in the system.\r",
"@version" => "1",
"@timestamp" => "2015-06-10T07:51:09.382Z",
"type" => "QUIKServ-log",
"host" => "S-MSK11-TST01",
"path" => "C:\\QUIK\\Server\\events.log"
}
{
"message" => "E: 10 Jun 15 (Wed) 07:05:17.837 (7912:6420:DWUSND): Running C:\\QUIK\\Server\\quik.exe: Error: Error: 'You are already working in the syste m.' while registering new user id 50\r",
"@version" => "1",
"@timestamp" => "2015-06-10T07:51:09.382Z",
"type" => "QUIKServ-log",
"host" => "S-MSK11-TST01",
"path" => "C:\\QUIK\\Server\\events.log"
}
My Logstash version is 1.5.0