I have a log file reading through the ftp process and I am using logstash to ingest the data.
A sample record is like that
Enter an FTP subcommand.
> PUT REPE533 AMTD_Statusfile.txt
227 Entering Passive Mode (10,133,104,90,7,136).
125 Data connection already open; Transfer starting.
226 Transfer complete.
157320 bytes transferred in 0.005 seconds. Transfer rate 32219.137 KB/sec.
Enter an FTP subcommand.
> QUIT
I just want to extract the message PUT REPE533 AMTD_Statusfile.txt and Transfer complete How should I grok the message with logstash? Here is the filter part of my config file.
if ([message] =~ /PUT/){
multiline{
pattern => "> "
what => "next"
}
grok{
match => {"message" => ['> %{GREEDYDATA: Command}\r\n%{GREEDYDATA:Message}\r\n%{SPACE}Enter an FTP subcommand.'] }
}
if ([Message] =~ /(Transfer Complete)/){
mutate {
add_field => {"Status" => "Transfer Complete"}
add_tag => "send_to_es"
}
}
mutate {
remove_field => "%{Message}"
add_tag => "send_to_es"
}
}