Logstash - Reference JSON files in a folder

Trying to get a configuration going in Logstash where I can reference multiple JSON files from a folder and have it process them accordingly -- not sure if this is at all the correct way to go about this, here is what I have so far

input {
syslog {
port => 514
codec => "json"
}
}

filter {
path => "/home/*.json" ]
}
}

output {
if [codec] == "json" {
elasticsearch {
hosts => "IP:9200"
http_compression => "true"
index => "testjson-%{+YYYY.MM.dd}"
}
}

I would start off with this:

input {
    file {
        path => "/tmp/foo/*.json"
        sincedb_path => "/dev/null"
        mode => "read"
        codec => multiline { pattern => "^Spalanzani" negate => true what => "previous" auto_flush_interval => 2 }
        file_completed_action => "log"
        file_completed_log_path => "/dev/null"
    }
}
filter { json { source => "message" } }
output { stdout { codec => rubydebug } }

You need to read up on what those options on the file input are doing.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.