Matching log.file.path with Grok

Elastic Stack Logstash
1

Hello!

So, I'm trying to use the log filename to generate a new field that is searchable on Kibana.

Currently I have this on my logstash pipeline:

    if "delivery_conn_results" in [tags] {
	grok {
		match => { 
                "log.file.path" => "/var/log/conn/(?<d1>.)/(?<d2>.)/(?<message_token>.*(?=\.))"
            }
		add_tag =>  [ "my_parsed_tag" ]
	}
	
	}

And this is the kind of file path I have:

    /var/log/conn/D/D/DD9A0BDC-D620-4705-9E63-A762AA7D8FA6.results

I've used grokconstructor to test the pattern and it should work. However, i'm getting a _grokparsefailure.

What should I do?

Thanks in advance!

1 Like
2

Hi again!

I changed it to:


match => { 
                "[log][file][path]" => "/var/log/conn/(?<d1>.)/(?<d2>.)/(?<message_token>.*(?=\.)).results"
            }

It works now! So I just had to use [log][file][path] instead of log.file.path.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.