How to prevent grok ingest processor to return parse error

Elastic Stack Elasticsearch
1

Hello,

I am using grok ingest processor to split my log lines into fields.

Sometimes it receives incorrectly formatted log line, returns an error to filebeat
java.lang.IllegalArgumentException: Provided Grok expressions do not match field value

and filebeat retries to send the same (unparsable) log line again and again, effectively stopping to send new logs at all.

This is not convenient: I want to have some king of "catchall" rule so that if grok can't parse log line for some reason, it will not return an error but rather store this line as a whole string (adding some other field like "unparsable": "true") so I can analyze them later and do not prevent filebeat to send logs.

How is it possible to achieve this?

Thanks in advance.

2

Ignore please, I somehow missed on_failure...

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.