This is how my logs look like. I am using multi grok parser to parse different type of logs but in same input file. Below is the grok filter that works for first log ^%{SOCBOX_HEADER}%{NUMBER}:%{NUMBER}:%{NUMBER} %{USERNAME:Server} %{USERNAME:AuditResult} %{NUMBER:EventID} (?<Message>([^#]*))Subjec…

Logstash parsing each log multiple times

system (system) Closed September 25, 2018, 5:49pm 6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
How to handle multiple match in logstash filter Logstash	6	10011	September 8, 2017
Logstash configuration: filters using GROK different logs from one type of log file Logstash	6	1448	July 6, 2017
Multiple grok filter Logstash	16	24109	October 3, 2017
Logstash Grok - duplicate entries after parsing Logstash	4	1585	March 20, 2018
Unable to parse logs Logstash	5	332	June 19, 2018

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Logstash parsing each log multiple times

Related topics