Logstash filter take everything after

Hi avrey one,
I wanted to filter this type of message:
ip ip text
I don't know the format of the text and what is inside of it.I only know that there is 2 ip and the text.
How i can geto something that I don't know is structurated? (I want to take the text but i don't know how it's made (it can have number and text))

I think, using the grok plugin is the best solution available for you.

Thank for your reply @Cad .
I have tried to use it but it give a _grokparsefailure.

                match => { "message"=> "%{IP:client} %{IP:destination} %{GREEDYDATA:request} " }

Can you give us an exemple of your data ?

I think you have to remove the last space after the GREEDYDATA pattern.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.