Logstash - match filename

Elastic Stack Logstash
1

I have two servers. The first one hosts elastic stack. Both servers have a file /var/log/commands.log which is configured in the same way and are being shipped with filebeat to logstash.

Using grok, I tried parsing the data into custom fields using this statement:

if [log][file][path] == "/var/log/commands.log" {
grok{
match => { "message" => "*some grok stuff*"
}
}
}

Problem is, even though on both servers the file is /var/log/commands.log & they're configured the same - it skips the if statement as if it's false.
I've noticed that if I ship the logs locally (without filebeat - just do input{file{input => "/var/log/commands.log}} ) it works for the local "/var/log/commands.log" file on that machine that hosts logstash.

For reference, this is the full .conf file for logstash: https://pastebin.com/1QbnAG7G
This is how elastic sees the file path: https://i.imgur.com/5h9HXf2.png

Does anyone why it skips the "if" statement? How to make it filter by name. Thanks ahead!

2

Hi,

In your shared conf, it seems that you use the regexp comparison operator =~ instead of ==.
So logstash thinks that "/var/log/commands.log" is a regex pattern

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.