Hi,
Logstash version 7.3.1, running with Docker compose.
Firstly, we don't want to use Filebeat to resolve this problem, at least for now. You can see below the output which we don't want like this.
Here our default pipeline configuration.
input {
tcp {
port => 5000
type => "json"
codec => "json"
}
udp {
port => 5000
type => "json"
codec => "json"
}
}
output {
stdout { codec => rubydebug }
if "_grokparsefailure" in [tags] or "_jsonparsefailure" in [tags] or "scheduling-1" in [thread] {
elasticsearch {
hosts => ["XX:9200"]
index => "parse-err-%{+YYYY.MM.dd}"
}
}
elasticsearch {
hosts => "XX:9200"
index => "logstash-%{+YYYY.MM.dd}"
}
}
If I don't use this condition:
if "_grokparsefailure" in [tags] or "_jsonparsefailure" in [tags] or "scheduling-1" in [thread]
None of these stack traces coming, and our expectation the entire stacktrace should be logged as single event.
How can we resolve this problem?
Kind regards.
~