Matching log.file.path with Grok


So, I'm trying to use the log filename to generate a new field that is searchable on Kibana.

Currently I have this on my logstash pipeline:

    if "delivery_conn_results" in [tags] {
	grok {
		match => { 
                "log.file.path" => "/var/log/conn/(?<d1>.)/(?<d2>.)/(?<message_token>.*(?=\.))"
		add_tag =>  [ "my_parsed_tag" ]

And this is the kind of file path I have:


I've used grokconstructor to test the pattern and it should work. However, i'm getting a _grokparsefailure.

What should I do?

Thanks in advance!

Hi again!

I changed it to:

match => { 
                "[log][file][path]" => "/var/log/conn/(?<d1>.)/(?<d2>.)/(?<message_token>.*(?=\.)).results"

It works now! So I just had to use [log][file][path] instead of log.file.path.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.