Logstash ignore logs grok filter

Elastic Stack Logstash
1

I want to capture the start time of a log, but if i use grok filter if there are some log with same info they all will be captured. How do i modify the filter as such it ignore rest of the logs with same pattern as soon as it find first match.
for example i have logs like this and i want only start time and end time, so the first line and last line.

[DEBUG main : 01/01/2020-00:07:11.884 : ValidationUtil] Validating Path:/opt/cford-app/
[DEBUG main : 01/01/2020-00:07:11.885 : ValidationUtil] Validating Path:/dump/
[DEBUG main : 01/01/2020-00:07:11.885 : ValidationUtil] Validating Path:/opt/middleware/
[DEBUG main : 01/01/2020-00:07:11.887 : ValidationUtil] Validating Path:/dump/term
[DEBUG main : 01/01/2020-00:07:11.889 : ValidationUtil] Validating Path:/opt/middleware2/

so result should be start time - 01/01/2020-00:07:11.884 , end time- 01/01/2020-00:07:11.889

2

You might be able to do it with an aggregate filter.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.