Logstash capture error message

Elastic Stack Logstash
1

Hi all,
I'm trying to capture the error message that is generated for a _dateparsefailure.

an example of message is this:

Failed parsing date from field {:field=>"Data/Ora Chiusura TT", :value=>"07/10/2015 11.04.12", :exception=>"Invalid format: "07/10/2015 11.04.12" is malformed at "/10/2015 11.04.12"", :config_parsers=>"dd/MM-YYYY HH.mm.ss,ISO8601", :config_locale=>"default=en_US", :level=>:warn}
Failed parsing date from field {:field=>"Data/Ora Chiusura TT", :value=>"06/10/2015 21.03.45", :exception=>"Invalid format: "06/10/2015 21.03.45" is malformed at "/10/2015 21.03.45"", :config_parsers=>"dd/MM-YYYY HH.mm.ss,ISO8601", :config_locale=>"default=en_US", :level=>:warn}
Failed parsing date from field {:field=>"Data/Ora Chiusura TT", :value=>"08/10/2015 15.03.25", :exception=>"Invalid format: "08/10/2015 15.03.25" is malformed at "/10/2015 15.03.25"", :config_parsers=>"dd/MM-YYYY HH.mm.ss,ISO8601", :config_locale=>"default=en_US", :level=>:warn}
Failed parsing date from field {:field=>"Data/Ora Chiusura TT", :value=>"11/10/2015 18.33.42", :exception=>"Invalid format: "11/10/2015 18.33.42" is malformed at "/10/2015 18.33.42"", :config_parsers=>"dd/MM-YYYY HH.mm.ss,ISO8601", :config_locale=>"default=en_US", :level=>:warn}
Failed parsing date from field {:field=>"Data/Ora Chiusura TT", :value=>"06/10/2015 21.04.27", :exception=>"Invalid format: "06/10/2015 21.04.27" is malformed at "/10/2015 21.04.27"", :config_parsers=>"dd/MM-YYYY HH.mm.ss,ISO8601", :config_locale=>"default=en_US", :level=>:warn}
Failed parsing date from field {:field=>"Data/Ora Chiusura TT", :value=>"10/10/2015 09.38.27", :exception=>"Invalid format: "10/10/2015 09.38.27" is malformed at "/10/2015 09.38.27"", :config_parsers=>"dd/MM-YYYY HH.mm.ss,ISO8601", :config_locale=>"default=en_US", :level=>:warn}
Failed parsing date from field {:field=>"Data/Ora Chiusura TT", :value=>"11/10/2015 14.25.56", :exception=>"Invalid format: "11/10/2015 14.25.56" is malformed at "/10/2015 14.25.56"", :config_parsers=>"dd/MM-YYYY HH.mm.ss,ISO8601", :config_locale=>"default=en_US", :level=>:warn}
Failed parsing date from field {:field=>"Data/Ora Chiusura TT", :value=>"07/10/2015 14.07.22", :exception=>"Invalid format: "07/10/2015 14.07.22" is malformed at "/10/2015 14.07.22"", :config_parsers=>"dd/MM-YYYY HH.mm.ss,ISO8601", :config_locale=>"default=en_US", :level=>:warn}
Failed parsing date from field {:field=>"Data/Ora Chiusura TT", :value=>"10/10/2015 09.57.24", :exception=>"Invalid format: "10/10/2015 09.57.24" is malformed at "/10/2015 09.57.24"", :config_parsers=>"dd/MM-YYYY HH.mm.ss,ISO8601", :config_locale=>"default=en_US", :level=>:warn}
Failed parsing date from field {:field=>"Data/Ora Chiusura TT", :value=>"11/10/2015 14.25.56", :exception=>"Invalid format: "11/10/2015 14.25.56" is malformed at "/10/2015 14.25.56"", :config_parsers=>"dd/MM-YYYY HH.mm.ss,ISO8601", :config_locale=>"default=en_US", :level=>:warn}
Failed parsing date from field {:field=>"Data/Ora Chiusura TT", :value=>"10/10/2015 09.57.24", :exception=>"Invalid format: "10/10/2015 09.57.24" is malformed at "/10/2015 09.57.24"", :config_parsers=>"dd/MM-YYYY HH.mm.ss,ISO8601", :config_locale=>"default=en_US", :level=>:warn}
Failed parsing date from field {:field=>"Data/Ora Chiusura TT", :value=>"10/10/2015 09.57.24", :exception=>"Invalid format: "10/10/2015 09.57.24" is malformed at "/10/2015 09.57.24"", :config_parsers=>"dd/MM-YYYY HH.mm.ss,ISO8601", :config_locale=>"default=en_US", :level=>:warn}
Failed parsing date from field {:field=>"Data/Ora Chiusura TT", :value=>"05/10/2015 09.57.43", :exception=>"Invalid format: "05/10/2015 09.57.43" is malformed at "/10/2015 09.57.43"", :config_parsers=>"dd/MM-YYYY HH.mm.ss,ISO8601", :config_locale=>"default=en_US", :level=>:warn}
Failed parsing date from field {:field=>"Data/Ora Chiusura TT", :value=>"10/10/2015 09.57.24", :exception=>"Invalid format: "10/10/2015 09.57.24" is malformed at "/10/2015 09.57.24"", :config_parsers=>"dd/MM-YYYY HH.mm.ss,ISO8601", :config_locale=>"default=en_US", :level=>:warn}
Failed parsing date from field {:field=>"Data/Ora Chiusura TT", :value=>"07/10/2015 12.27.27", :exception=>"Invalid format: "07/10/2015 12.27.27" is malformed at "/10/2015 12.27.27"", :config_parsers=>"dd/MM-YYYY HH.mm.ss,ISO8601", :config_locale=>"default=en_US", :level=>:warn}
Failed parsing date from field {:field=>"Data/Ora Chiusura TT", :value=>"06/10/2015 19.27.41", :exception=>"Invalid format: "06/10/2015 19.27.41" is malformed at "/10/2015 19.27.41"", :config_parsers=>"dd/MM-YYYY HH.mm.ss,ISO8601", :config_locale=>"default=en_US", :level=>:warn}

I would like to take this message and I will write to a file , how can I do it ?

thank you

2

How about configuring Logstash to read its own logfile and drop all lines except those that begin with "Failed parsing date from field"?

3

I am creating a log file , now does not know where that message is write .
I see those messages from my virtual terminal

4

I'm afraid I don't understand.

5

yes, sorry for my English

i don't take this message from a log file, but i see this message when i launch logstash on a virtual terminal..... and i want take that error message and put it on a file

6

Okay, but normally when you run Logstash for real the text you're talking about is logged to a logfile, typically /var/log/logstash/logstash.log. Configure Logstash to read that file.

7

I do not have that file (logstash.log) and that folder (logstash)

8

Okay. Well, you should configure Logstash to save its logs to a file. Use the -l command line option.

9

ok tnks