I have one log file with two different format, And now, I want to match them together ,and I write logstash-filter in below way.
filter{
if [type] == "test" {
grok {
match => {"message" => "%{WORD:logger}\s+%{GREEDYDATA:information}"}
if [logger] == "api_playlist" {
grok {
match => {"information" => "%{GREEDYDATA:test1}"}
}
}
else if [logger] == "grpc_playlist" {
grok {
match => {"information" => "%{GREEDYDATA:test2}"}
}
}
}
}
}
AND my log file is
api_playlist 2017-12-20 09:26:37 0f957a40 null amzn1.account.AGYYSC3H4MWTZXRZHT4SQWP67AHA Discover null undefined Done 0.346
2017-12-20 09:26:56 0ff2cdbf null amzn1.account.AEOIL2NUCQRJI23M7UH3BXS2QN5Q Discover null undefined Done 0.251
grpc_playlist 2017-12-20 09:26:37 0f957a40 null amzn1.account.AGYYSC3H4MWTZXRZHT4SQWP67AHA Discover null undefined Done 0.346
2017-12-20 09:26:56 0ff2cdbf null amzn1.account.AEOIL2NUCQRJI23M7UH3BXS2QN5Q Discover null undefined Done 0.251
But I failed,What's my problem or Anyway else can meet my require?
THANKS!