Is logstash supports multiple grok pattern?

Elastic Stack Logstash
1

filter {
grok {
match => { "message" => [
"%{TIMESTAMP_ISO8601:timestamp} [%{LOGLEVEL:loglevel}] %{GREEDYDATA:message}",

  "\[%{LOGLEVEL:log_level}\] System Metrics: CPU %{NUMBER:cpu_usage}%\, Memory %{NUMBER:memory_usage}%\, Disk %{NUMBER:disk_usage}%\, Network In %{NUMBER:network_in} Mbps\, Out %{NUMBER:network_out} Mbps \| App Metrics: Requests %{NUMBER:request_time}\, Avg Response %{NUMBER:avg_response_time}ms\, Errors %{NUMBER:error_rate}%"

]}

}
}

here this is the configuration is my logstash , because my logs contain multiple grok pattern so verify this should be correct or not ?

2

like this

Screenshot from 2024-04-29 12-01-53
Screenshot from 2024-04-29 12-01-531366×768 71.5 KB

3

Hi @abhishekacharya828

Yes, Logstash grok filter plugin support multiple pattern to parse data.

Thanks

1 Like
4

Just need to follow available options that logstash provided to you.
for example:

Thanks

1 Like