Hi,
I have a logfile like this
2016-03-10 04:49:41,586 p=8250 u=root | TASK [filetester : Display messages] *******************************************
2016-03-10 04:49:41,619 p=8250 u=root | skipping: [MYLABSERVER]
2016-03-10 04:49:41,621 p=8250 u=root | TASK [filetester : Copying files] **********************************************
2016-03-10 04:49:43,467 p=8250 u=root | changed: [MYLABSERVER]
2016-03-10 04:49:43,551 p=8250 u=root | PLAY RECAP *********************************************************************
2016-03-10 04:49:43,551 p=8250 u=root | MYLABSERVER : ok=2 changed=1 unreachable=0 failed=0
My intended output is,
MYLABSERVER , filetester, ok
But I am getting all of them in different patterns
This is my logstash file,
input {
file {
path => ["ansible.log"]
start_position => "beginning"
}
}
filter {
if "PLAY" in [message] {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:date} p=%{INT:process} u=%{USER:user} \| %{WORD:action} %{GREEDYDATA:message}" }
add_tag => ["Play"]
}
}
else if "TASK" in [message] {
grok {
match => { "message" =>"%{TIMESTAMP_ISO8601:date} p=%{INT:process} u=%{USER:user} \| %{WORD:action} \[%{WORD:role} : %{GREEDYDATA:message}\]" }
add_tag => ["_Action"]
}
}
else if "skipping" in [message] {
drop {}
}
else {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:time} p=%{INT:pid} u=%{WORD:user} \| %{HOSTNAME:host} : %{WORD:status}=%{INT:change} %{WORD:changes}=%{INT:NumberofChanges} %{WORD:Reachable}=%{INT:Failure} %{WORD:Fails}=%{INT:failednumbers}" }
add_tag => ["PlayBookRun_Status"]
}
}
}
output {
stdout { codec => rubydebug}
}
Regards,
A