How to push droped events into elastic search

Elastic Stack Logstash
1

I have to index dropped events from filter plugin into elastic search . below is a sample code.

filter{

grok {
       match =>{ "message" => "(?<tran_type_isg>(?<=^.{58}).{3})(?<trash>.{11})(?<tran_type_ab>.{3})"}
       
       }
#checking transaction type and parsing
 if [tran_type_ab] == "ABC"{
     #do something
	 match => { "message" => "(?<CRD_NO>(?<=^.{58}).{3})"  }
 } 
 else if [tran_type_ab] == "DEF"{
 #do something
 }
 else{
 
 drop{}
 #how to index dropped events into elastic search?
 }
}

I also would like to know the location where dropped events are placed if any?

thanks
for reading and helping

2

They are not placed anywhere. They are dropped -- i.e. deleted. If you want to index them then do not drop them.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.