I am using
grok ingest processor to split my log lines into fields.
Sometimes it receives incorrectly formatted log line, returns an error to filebeat
java.lang.IllegalArgumentException: Provided Grok expressions do not match field value
and filebeat retries to send the same (unparsable) log line again and again, effectively stopping to send new logs at all.
This is not convenient: I want to have some king of "catchall" rule so that if grok can't parse log line for some reason, it will not return an error but rather store this line as a whole string (adding some other field like "unparsable": "true") so I can analyze them later and do not prevent filebeat to send logs.
How is it possible to achieve this?
Thanks in advance.