We are running ELK 7.6.2 stack in our environment.
The log generated by our application throws out messages with different Log Levels. Please see below example:
2021-10-31 19:00:01,062|DEBUG|DispatcherServlet|anonymous-18.104.22.168.106-TVZ-PCVLSB69GCBUWD1NCMAVMYJJJ4YC6KG1744901501|Exiting from "ASYNC" dispatch 2021-10-31 19:00:01,059| INFO|HttpRequestUtil|anonymous-22.214.171.124.106-TVZ-PCVLSB69GCBUWD1NCMAVMYJJJ4YC6KG1744901501|ERROR STATUS CODE 500 2021-10-31 19:00:01,060| INFO|ErrorController|anonymous-126.96.36.199.106-TVZ-PCVLSB69GCBUWD1NCMAVMYJJJ4YC6KG1744901501|ERROR ASYNC HANDLER async isCommitted=false 2021-10-31 19:20:01,286| INFO|HttpRequestUtil|anonymous-188.8.131.52-1-01-CV-PCVY73MMUJJ3LBIMAMGJ97EBIPLWJWG1745536201@1-1163547#17|ERROR STATUS CODE 401 2021-10-31 19:20:32,606|ERROR|SlUtil|184.108.40.206-TVZ-PCVZXJECFBRFBM43FFEREJUAFEUWUMG4732288802@1-1163852#17|Parsing the request failed
Filebeat agent running on the server pushes this content to Logstash.
I want Logstash to just parse/ filter the line that has "ERROR" as Log Level (Last line in the sample log above) and push it to Elasticsearch. The rest should be discarded.
Please guide on how this could be achieved.