Hi all,
I am trying to setup a log management system. I wanted to get response time in a single event hence i used aggregation. But this config is giving me error at the first If statement
i am pretty sure other errors would come to if its even passes this one.
as
Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, => at line 14, column 12 (byte 332) after filter {\n grok {\n match => { "message" => "\[%{TIMESTAMP_ISO8601:timestamp}] - (Status | Time):%{WORD:transaction}, Req ID:%{GREEDYDATA:tid}, User:%{GREEDYDATA:user}"}\n }\n\n filter {\n if ",
Any help would be greatly appreciated.
input {
file {
path => "/home/rajdeep/Desktop/nd"
start_position => "beginning"
}
}
filter {
grok {
match => { "message" => "\[%{TIMESTAMP_ISO8601:timestamp}] - (Status | Time):%{WORD:transaction}, Req ID:%{GREEDYDATA:tid}, User:%{GREEDYDATA:user}"}
}
filter {
if [message] =~ "Status" {
grok {
match => { "message" => "\[%{TIMESTAMP_ISO8601:timestamp}] - (Status | Time):%{WORD:transaction}, Req ID:%{GREEDYDATA:tid}, User:%{GREEDYDATA:user}"}
}
aggregate {
task_id => "%{tid}"
code => "
map['user'] = event.get('user')
map['timestamp'] = event.get('timestamp')
"
map_action => "create"
}
drop{}
}
if [message] =~ "Time" {
grok {
match => { "message" => "\[%{TIMESTAMP_ISO8601:timestamp}] - (Status | Time):%{WORD:transaction}, Req ID:%{GREEDYDATA:tid}, User:%{GREEDYDATA:user}"}
remove_field => ["message"]
}
aggregate {
task_id => "%{tid}"
code => "
event.set('user', map['user'])
event.set('request-time', map['timestamp'])
event.set('time', 'full')
"
map_action => "update"
end_of_task => true
push_map_as_event_on_timeout => true
timeout => 120
timeout_task_id_field => "tid"
timeout_code => "
event.set('response', 'Response-timeout')
event.set('type', 'request-response')
event.set('transaction', 'request')
"
}
ruby {
init => "require 'time'"
code => "duration = (DateTime.parse(event.get('response-time')).to_time.to_f*1000 -
DateTime.parse(event.get('request-time')).to_time.to_f*1000)
rescue nil; event.set('service-time', duration); "
}
}
}
}
Output is configured to stdout and elastic search.