Match part of a log

Elastic Stack Logstash
#1

I've seen how to match certain logs, and match every line. But i want to do something a little different (if possible??)

I want to parse a log (that has many different line formats, looking for a particular keyword and then forward the variable pairs from this line to elastic, dropping all the other lines.

the line (and only line) will contain
Feb 18 11:51:36 07[IKE] <ikev1 22400> assigning virtual IP xx.xx.xx.xx to peer 'yyyyyyyy'
i want this, i want parts date, ip and peer

not all lines in the log (charon) will be like this

is this possible?

#2

Use conditionals to select for which messages the drop filter should be used. To extract certain parts of the message to separate fields use the grok filter as usual.

#3

thanks,
as i see it the only way is to create match patterns for the drop?
and then grok the one i want?

was hoping i could work a way of grok one thing i want, and drop anything else..

#4

Well, you could do

grok {
  match => ...
}
if "_grokparsefailure" in [tags] {
  drop { }
}

to drop all events that don't match the grok expression.

#5