Matching multiple logs to differnt patterns

Elastic Stack Logstash
1

I'm using filebeat to send log files from different servers to logstash. Srv1 has an index of nginx, while srv2 has it set to apache.

I have 2 patterns SED_NGINX_COMBINE(custom) and HTTPD_COMBINELOG (builtin).

Not sure how or what is the best way to match these records as they are coming in.

tried :

grok {
patterns_dir => ["/etc/logstash/patterns"]
match => {
"message" => "%{SED_NGINX_COMBINE}"
"message" => "%{HTTPD_COMBINELOG}"
}

but it didn't like this.

Just not sure how to go about this or should I create a second xxx.conf file for the different log files with a different index for Elasticsearch.

2

The grok filter documentation contains an example of how to use multiple grok expressions in the same filter.

3

Thanks that was incredibility unhelpful !

4

Seriously, why wasn't that helpful? You're having syntax issues getting multiple grok expressions working in a single filter and I pointed you to where you could find examples of just that.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.