Logstash parse only JSON messages

(Arun A Nayagam) #1

I want to parse various different messages being logged into cloudwatch. And I am planning to use logstash-input-cloudwatch-logs plugin.

Now there are a lot of non-json messages written into cloudwatch, I want to ignore all of them. I only want proper json messages to be parsed.

I know that I can use the json filter and drop messages that have a tag of "_jsonparsefailure"

But somehow this feels inefficient, as the attempt to json parse is done and then a decision to drop is made.

Is there a more efficient way to drop non-json messages?


(Magnus B├Ąck) #2

Well, you could use a conditional that drops all events that don't begin with {.

if [message] !~ /^\{/ {
  drop { }

(Arun A Nayagam) #3

Thank you so much. That helps.


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.