# Logstash for application.log + application.log.1.gz

**URL:** <https://discuss.elastic.co/t/logstash-for-application-log-application-log-1-gz/351577>\
**Category:** Logstash\
**Created:** [January 22, 2024, 8:52pm UTC](https://discuss.elastic.co/t/logstash-for-application-log-application-log-1-gz/351577 "2024-01-22T20:52:29Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![RavaliJ](https://avatars.discourse-cdn.com/v4/letter/r/d2c977/32.png) [@RavaliJ](https://discuss.elastic.co/u/RavaliJ)\
**Post date:** [January 22, 2024, 8:52pm UTC](https://discuss.elastic.co/t/logstash-for-application-log-application-log-1-gz/351577/1 "2024-01-22T20:52:29Z")

</div>

Hi,

I have Rolling file appenders in my java code which creates log files like - application.log, application.log.1.gz,application.log.2.gz so on. I want to index all of these and make sure messages from log files are read.  
PFB logstash.config, but this seems not working.Kindly suggest  
input{  
file {  
path =\> [  
"/path/to/application.log",  
"path/to/application.log.1.gz  
]  
codec =\> gzip\_lines {}  
}  
filter{  
if [path] =~ /^/application.log(?:.\d+)?.gz(?:.|%{NUMBER})?$/ {  
grok {  
match =\> { "message" =\> "Published symbol:%{NUMBER:Published\_count:int}" }  
}  
}  
}

Installed :bin/logstash-plugin install logstash-codec-gzip\_lines

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 22, 2024, 10:20pm UTC](https://discuss.elastic.co/t/logstash-for-application-log-application-log-1-gz/351577/2 "2024-01-22T22:20:54Z")

</div>

You will need a file input with the default codec to read "/path/to/application.log", and a second input with a gzip\_lines codec to read the rotated files.

However, unless you are working with a static backup of live logs the normal use case would be just to read application.log. When that is rotated and compressed logstash will already have read the data and does not need to re-read the gzipped file.

---

<div class="post-metadata">

**Author:** ![RavaliJ](https://avatars.discourse-cdn.com/v4/letter/r/d2c977/32.png) [@RavaliJ](https://discuss.elastic.co/u/RavaliJ)\
**Post date:** [January 23, 2024, 7:46pm UTC](https://discuss.elastic.co/t/logstash-for-application-log-application-log-1-gz/351577/3 "2024-01-23T19:46:41Z")

</div>

Got it. Also i need to apply grok filters for specific log file from a list.  
Example:  
file {  
path =\> [  
"/var/app/log/process1.log",  
"/var/app/log/process2.log",  
"/var/app/log/process3.log"  
]  
start\_position =\> "beginning"  
discover\_interval =\> 10  
codec =\> plain { }  
}  
However my  
filter {  
if [path] == "/var/app/log/process1.log" {  
//code inside this is never called  
grok{  
//logic resides here  
}  
}  
}  
any suggestions?

---

<div class="post-metadata">

**Author:** ![RavaliJ](https://avatars.discourse-cdn.com/v4/letter/r/d2c977/32.png) [@RavaliJ](https://discuss.elastic.co/u/RavaliJ)\
**Post date:** [January 29, 2024, 6:43pm UTC](https://discuss.elastic.co/t/logstash-for-application-log-application-log-1-gz/351577/4 "2024-01-29T18:43:06Z")

</div>

Hi any suggestions on my above request

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [January 29, 2024, 8:14pm UTC](https://discuss.elastic.co/t/logstash-for-application-log-application-log-1-gz/351577/5 "2024-01-29T20:14:35Z")

</div>

Should be:  
`if [log][file][path] == "/var/app/log/process1.log" {`

And question, do you need IF at all?

---

<div class="post-metadata">

**Author:** ![RavaliJ](https://avatars.discourse-cdn.com/v4/letter/r/d2c977/32.png) [@RavaliJ](https://discuss.elastic.co/u/RavaliJ)\
**Post date:** [February 2, 2024, 8:59pm UTC](https://discuss.elastic.co/t/logstash-for-application-log-application-log-1-gz/351577/6 "2024-02-02T20:59:08Z")

</div>

Yes i would need IF as i have to read different logs from different files and drop rest all

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 1, 2024, 8:59pm UTC](https://discuss.elastic.co/t/logstash-for-application-log-application-log-1-gz/351577/7 "2024-03-01T20:59:24Z")

</div>

Closed on March 1, 2024, 8:59pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.