Hi,
I listening to the port 31230 to get syslogs from a router. The logs are coming in but it doesnt use my grok filter. Kibana uses some default index pattern for syslogs.
input {
syslog {
type => "syslog"
port => 31230
}
}
filter {
grok
{
break_on_match => false
pattern_definitions => { "mssg" => "((Msg|message|Message|message1|message2|Message1|Message2) [=])"
"nhchg" => "%{WORD} -> %{WORD}"
"debug" => "NDP-DBG"
}
match => {
"message" => ["%{TIMESTAMP_ISO8601:timestamp} %{WORD:node}:%{WORD:program}:%{INT:pid} %{WORD:tracetype}.*%{mssg} \"%{GREEDYDATA:Message}\""]
"Message" => ["%{debug:NDPdebug}:%{DATA:function}:%{INT:line}:: %{GREEDYDATA:msg}", "NexthopId %{WORD:nexthop_id}", "state %{WORD:state}", "event %{WORD:event}", "Prefix %{DATA:prefix}/", "NhType_change %{nhchg:nhtype_change}"]
}
}
}
There is no error in the configuration. I have tried running it by getting input from a file.