Logstash stdout event

Elastic Stack Logstash
1

I want to print some events from log file before upload to elasticsearch on stdout console but I don't know why don't work this conf file for me.

input{
file{
type => "log"
codec => "json"
path => "/var/log/test.log"
start_position => "beginning"
sincedb_path => "/var/test/sincedb/.sincedb_log"
}

filter {

grok {
match => ["message", "%{SYSLOGBASE} %{URIPATH:url}%{GREEDYDATA:datagreedy}"]
}

if "http://google.com" == [url]{
metrics{
meter => "google_events"
add_tag => "google"
}
}
}

output{

if "google" in [tags]{
stdout {
codec => line { format => "count: %{[google_events][count]} - %[message]"
}
}
elasticsearch {
index => "test"
hosts => ["http://localhost:9200"]
}
}

2

How do you know the url field is ever equal to "http://google.com"?

3

Only if url field is "http://google.com" I want a google event message on standard output that don't work because %[message] on standard output is empty. Elasticsearch upload is work fine because I upload all events.

4

And what are you getting in ES?

5

All logs uploaded have:
timestamp
source
destination
url
user
message

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.