Logstash failed to differentiate log filtering based on data source IP address

Elastic Stack Logstash
1

Send logs from multiple systems through syslog to logstash, which can receive logs normally. In order to distinguish logs sent from different systems, it is necessary to distinguish them based on the IP address of the data source. As long as if [host]="10.1.100.9" is added, the condition does not hold, and debug logs cannot continue to be output. If this check statement is not added, debug logs can be output normally. In version 6.4 of logstash, using the same configuration, debug logs can be output normally, The current version of logstash is 8.12.0, and the following is the configuration of logstack.conf

input{
 syslog{
   port => 514
 }
}
output {
   if [host] == "10.1.100.9" {
     stdout {
         codec => rubydebug
     }
  }
}

The following is the original log output:

image
image1466×470 15.3 KB

2

Welcome to the community.

Please use the nested fields. In your case should be:
if [host][ip] == "10.1.100.9" {

3

Thank you very much for your answer. Based on the method you provided, we have perfectly solved this problem :smiley:

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.