Logstash not adding new field tag

[inuygoku]

I am trying to create a filter that will for event in my logs and add it to a field called "detected_event".

The filter I created is the following:

filter {
    if "Scan completed" in [logline] {
        mutate {
            add_field => { "detected_event" => "scan_completed" }
        }
    }
}

In my logs if a Scan has completed it would have the something like the following line in the logline message:

"Scan completed: 5fa2d007d1cc991ff9d90aa2 5fa2d0936e2b8d567f31b5f5"

When I added the filter and run my scans again, logstash had not added the filter I had in the filter configuration file.

My end goal here is to simply have a field I can query against instead of having to parse large log lines in kibana

[elasticforme (Sachin)]

@inuygoku

filter {
    if "completed" in [logline] {
        mutate {
            add_field => { "detected_event" => "scan_completed" }
        }
    }
}

try as above to see if you have detected_event created. if it does then your matching is not working.

I might try this as well
if ([logline] =~ /Scan completed:/) {

}

[elasticforme (Sachin)]

for exact matching I have used == in past