Is it possible to have a reusable template for the line codec format?

Elastic Stack Logstash
1

**Is it possible to have a reusable template for the line codec format ? The same is in multiple places so it would be nice to have it once so all messages are the same regardless of which file { … } it was generated from

2

Can you give an example of what you hope to achieve?

3

output {
stdout { }
file {
path => "/home/local/logs"
codec => line { format=>"%{message}" }
}
file {
path => "home/local/cons.log"
codec => line { format=>"%{message}" }
}
file {
path => "/home/local/cons.json"
codec => json
}
if [label] == "DEBUF" or [label] == "INFO" {
email {
to => ""
from => ""
via => "sendmail"
subject => "%{severity_label}: %{program} %{host} %{xmessage}"

  }

file {
path => "/home/local/label.log"
codec => line { format=>"%{message}" }
}

}

}

the output filter have codec line have in multiple places. all codec lines have same format , so instead of multiple codec line is it possible single codec line for all logs.

4

I don't think so, but it doesn't really take long to copy and paste a few lines

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.