Logstash Grep and Drop

Elastic Stack Logstash
1

I have an old conf file my predecessor made with grep in it for logstash. Under that is the Drop command. What can I use as the equivalent to make it still work the same way?

if [SourceModuleName] == 'eftxferlogs' {

    grok {
        match => [ 'message', '%{TIMESTAMP_ISO8601:EventTime} %{IPORHOST:FTPClientIpAddress} - %{NOTSPACE:FTPUserName} %{NAGIOSTIME}(?<FTPCommand>%{WORD} %{NOTSPACE}) - %{NOTSPACE:FTPStatusCode} %{NOTSPACE:FTPDownloadedBytes} %{NOTSPACE:FTPUploadedBytes} %{NOTSPACE:FTPServerIP} %{NOTSPACE:FTPServerPort}' ]
    }

    date {
        match => [ 'EventTime', 'YYYY-MM-dd HH:mm:ss' ]
        timezone => 'UTC'
    }

    dns {
        reverse => [ 'host' ]
        action => 'replace'
    }

    # Tag all sent/downloaded files
    #
    grep {
        match => [ 'FTPCommand', '^sent.*$' ]
        add_tag => 'sent_file'
        drop => 'false'
    }

Is the Drop command the same as break_on_match?

Instead of using grep in the old config which is obviously broken since I updated logstash I need to find something that will serve the same purpose.

Thanks,
Jack

2 
if [FTPCommand] =~ /^send.*$/ {
  mutate {
    add_tag => 'sent_file'
  }
}
3

replace the grep portion with this?

4

Yes, that's right.

1 Like