Matching multiple logs to differnt patterns

I'm using filebeat to send log files from different servers to logstash. Srv1 has an index of nginx, while srv2 has it set to apache.

I have 2 patterns SED_NGINX_COMBINE(custom) and HTTPD_COMBINELOG (builtin).

Not sure how or what is the best way to match these records as they are coming in.

tried :

grok {
patterns_dir => ["/etc/logstash/patterns"]
match => {
"message" => "%{SED_NGINX_COMBINE}"
"message" => "%{HTTPD_COMBINELOG}"

but it didn't like this.

Just not sure how to go about this or should I create a second xxx.conf file for the different log files with a different index for elastic search.

The grok filter documentation contains an example of how to use multiple grok expressions in the same filter.

Thanks that was incredibility unhelpful !

Seriously, why wasn't that helpful? You're having syntax issues getting multiple grok expressions working in a single filter and I pointed you to where you could find examples of just that.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.