Logstash Add Tag if Message Starts With

We are using the Jenkins logstash plugin. So the logstash config is just an input and ouput. The plugin sends pre-formatted json, so not much to do besides collect and forward. We want to enrich based off the type of log sent to the Jenkins console.

We are attempting to add a tag to Jenkins console logs if the message output start with a particular character. The message could start with an I, W, or E and we want to say "if message starts with W, add tag "warning" or "if message starts with E, add tag "error." How can i add a filter that says, "if it starts with x, add y, OR if is starts x1 add y1, OR if it starts with x2 add y2, else just pass the message through?

Example message fields:

W0418 02:00:29.358414 74475 Report.cc:188] Total Duration : 6 min, 24 secs

I0418 02:00:29.358414 74475 Report.cc:188] Total Duration : 6 min, 24 secs

E0418 02:00:29.358414 74475 Report.cc:188] Total Duration : 6 min, 24 secs

Use grok to parse the first character off

grok { match => { "message" => "^(?<[@metadata][char]>.)" } }

Then use a translate filter to map that.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.