Hi, i am sending two different logs files with filebeat agent with different tags on filebeat side to logstash but logstash only able to parse one file and failing for other . Below is my config.
Can someone help .
input {
beats {
client_inactivity_timeout => 86400
port => 5044
type => "log"
}
}
filter {
if "vus" in [tags] {
mutate {
gsub => [
"message", "\t", " ",
"message", "\n", " "
]
}
grok {
match => { "message" => "\[%{TIMESTAMP_ISO8601:timestamp_match}\]%{SPACE}%{WORD:level}%{SPACE}%{JAVACLASS:coidkey}%{SPACE}%
{USER:ident}%{SPACE}%{GREEDYDATA:Url}"}
}
}
else if "download" in [tags] {
mutate {
gsub => [
"message", "\t", " ",
"message", "\n", " "
]
}
grok {
match => { "message" => "\[%{TIMESTAMP_ISO8601:timestamp_match}\]%{SPACE}\:\|\:%{SPACE}%{WORD:level}%{SPACE}\:\|\:%{SPA
CE}%{USERNAME:host_name}%{SPACE}\:\|\:%{SPACE}%{DATA:coidkey}%{SPACE}\:\|\:%{SPACE}%{GREEDYDATA:clientinfo}%{SPACE}\:
\|\:%{SPACE}(%{IP:clientip})?%{SPACE}\:\|\:%{SPACE}%{GREEDYDATA:Url}%{SPACE}\:\|\:%{SPACE}%{JAVACLASS:class}%{SPACE}\:\|\:%
{SPACE}%{USER:ident}%{SPACE}%{GREEDYDATA:msg}"}
remove_field => [ "ident","offset","name","version","host" ]
}
}
}
output {
stdout { codec => rubydebug }
if "_grokparsefailure" in [tags] {
# write events that didn't match to a file
file { "path" => "/tmp/grok_failures.txt" }
}
# if "vus" in [tags] {
# elasticsearch {
# hosts => "dfdevelasticp1.df.jabodo.com:9200"
# user => "elastic"
# password => "fd5dd89c"
# index => "download-%{+YYYY.MM.dd}"
# document_type => "log"
# }
# }
#if [type] == "download"{
else{
elasticsearch {
hosts => "dfsyselastic.df.jabodo.com:9200"
user => "UN"
password => "PW"
index => "vicinio-%{+YYYY.MM.dd}"
document_type => "log"
}
}
}
I have tested both my grok they work fine alone.