Load custom grok patterns at startup

Elastic Stack Logstash
1

Is it possible to load custom grok patterns at the startup of logstash ?

i would like to avoid loading grok filters each time

filter {
grok {
patterns_dir => "/etc/logstash/grok/"
match => { "message" => "%{CALL}" }
add_field => { "[@metadata][pattern]" => "parsed" }
tag_on_failure => [call_parse_error]
}
if "call-in" in [message] {
csv { separator => "|"
columns => ["timestamp","id","call_type","plan_id","bill_id","caller","callee"]
add_field => { "[@metadata][csv]" => "matched" } }
}
else if "call-out" in [message] {
csv { separator => "|"
columns => ["timestamp","id","call_type","plan_id","bill_id","caller","callee"]
add_field => { "[@metadata][csv]" => "matched" } }
}

grok {
patterns_dir => "/etc/logstash/grok/"
match => { "message" => "%{MSG}" }
add_field => { "[@metadata][pattern]" => "parsed" }
tag_on_failure => [msg_parse_error]
}
if "sms-in" in [message] {
csv { separator => "|"
columns => ["timestamp","id","msg_type","plan_id","bill_id","Anumber","Bnumber"]
add_field => { "[@metadata][csv]" => "matched" } }
}
else if "sms-out" in [message] {
csv { separator => "|"
columns => ["timestamp","id","msg_type","plan_id","bill_id","Anumber","Bnumber"]
add_field => { "[@metadata][csv]" => "matched" } }

}

}

2

No; there is no way to set a global configuration that affects all instances of a plugin.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.