Logstash Configuration with custom patterns

Elastic Stack Logstash
1

I want to read application specific logs especially for exception. So i created a "patterns" folder in config folder and added the patterns and the file looks like :

#Extra patterns for grok
EISLOGFORMAT %{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level}\s*%{JAVACLASS:class}\.%{WORD:method} %{NUMBER:timeTakenForExecution:"\d+"}\s*-\s*%{GREEDYDATA:log}
EISEXCEPTIONFORMAT %{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level}\s*%{JAVACLASS:class}.*: %{JAVACLASS:exception}.*

and in my conf file i have added "patterns_dir=>"./patterns" " under filter,grok snippet.

But when i start my logstash i see error :

> [2018-07-24T15:11:35,028][ERROR][logstash.pipeline        ] Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<Grok::PatternError: pattern %{EISLOGFORMAT:eisText} not defined>, :backtrace=>["C:/tools/logstash-6.3.0/vendor/bundle/jruby/2.3.0/gems/jls-grok-0.11.4/lib/grok-pure.rb:123:in `block in compile'", "org/jruby/RubyKernel.java:1292:in `loop'", "C:/tools/logstash-6.3.0/vendor/bundle/jruby/2.3.0/gems/jls-grok-0.11.4/lib/grok-pure.rb:93:in `compile'", "C:/tools/logstash-6.3.0/vendor/bundle/jruby/2.3.0/gems/logstash-filter-grok-4.0.3/lib/logstash/filters/grok.rb:281:in `block in register'", "org/jruby/RubyArray.java:1734:in `each'", "C:/tools/logstash-6.3.0/vendor/bundle/jruby/2.3.0/gems/logstash-filter-grok-4.0.3/lib/logstash/filters/grok.rb:275:in `block in register'", "org/jruby/RubyHash.java:1343:in `each'", "C:/tools/logstash-6.3.0/vendor/bundle/jruby/2.3.0/gems/logstash-filter-grok-4.0.3/lib/logstash/filters/grok.rb:270:in `register'", "C:/tools/logstash-6.3.0/logstash-core/lib/logstash/pipeline.rb:340:in `register_plugin'", "C:/tools/logstash-6.3.0/logstash-core/lib/logstash/pipeline.rb:351:in `block in register_plugins'", "org/jruby/RubyArray.java:1734:in `each'", "C:/tools/logstash-6.3.0/logstash-core/lib/logstash/pipeline.rb:351:in `register_plugins'", "C:/tools/logstash-6.3.0/logstash-core/lib/logstash/pipeline.rb:729:in `maybe_setup_out_plugins'", "C:/tools/logstash-6.3.0/logstash-core/lib/logstash/pipeline.rb:361:in `start_workers'", "C:/tools/logstash-6.3.0/logstash-core/lib/logstash/pipeline.rb:288:in `run'", "C:/tools/logstash-6.3.0/logstash-core/lib/logstash/pipeline.rb:248:in `block in start'"], :thread=>"#<Thread:0x77630be7 run>"}
> [2018-07-24T15:11:35,064][ERROR][logstash.agent           ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}

kindly suggest

2

you can just try : patterns_dir=>"patterns"

3

Sorry for the confusion but i tried that nogo ...

I have given the name of the file as morepatterns though should i be using it anywhere ?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.