Thanks, I was testing different aspects of this case, so it took time to post the reply here.
Any way, here's the summarized method from what @Badger mentioned in previous post; to initiate and use grok filter plugin (or any other filter generally):
init section:
- initialize
@grok_filter = LogStash::Filters::Grok.new(
"match" => { "message" => "PATTERN" },
"tag_on_failure" => ["_grokparsefailure"]
# .... and literally any other config option you'd pass into grok plugin in filter pipeline
)
- Register
@grok_filter.register
code section:
- Utilize
@grok_filter.filter(event)
However, I faced a relevant new issue which will post in another topic. Thank you @Badger