Hi there,
this is my pepiline.conf:
input {
file {
path => "c:/logstash.log"
start_position => "beginning"
sincedb_path => "/dev/null"
codec => multiline {
pattern => "^%{TIME}"
negate => true
what => previous
}}}
filter {
grok{
match => { "message" => "%{TIME:date} %{LOGLEVEL:level} %{GREEDYDATA:message}" }
add_tag => [ "groked" ]
remove_tag => ["_grokparsefailure"]
}}
output {
if "ERROR" in [level]
{
elasticsearch {
hosts=>"localhost:9200"
index => "errors"
document_type => "error"
} }
stdout { codec => rubydebug }
}
I get this result in elasticsearch:
message: [
"16:54:46,234 ERROR [stderr] (ServerService Thread Pool -- 42) at org.slf4j.impl.StaticLoggerBinder.<clinit>(StaticLoggerBinder.java:55)",
"[stderr] (ServerService Thread Pool -- 42) at org.slf4j.impl.StaticLoggerBinder.<clinit>(StaticLoggerBinder.java:55)"
]
As you see the message error is dublicated.So,how can i keep juste the seconde message.
Thank you for your helps.