Multiple dissect in logstash

Elastic Stack Logstash
1

Hi,

I would like somehow to have multiple dissect or grok
one for Errorlog :
dissect { mapping => { "message" => "[%logdate}] %{exception}.%{CHttpException}.%{logtype}.%{loglevel}: %{errormessage}" } }

and second one for Info log but the syntax is different:

[2020-10-21 14:51:33] application.INFO:
"message" => "[%logdate}] %{application}.%{loglevel}: %{infomessage}"

  1. Is it possible to use "dissect" for two differant syntaxes?
  2. if not what can I use?
2

You can have multiple dissect filters. The documentation suggests using if conditions to determine which dissect to apply.

1 Like
3

Hi, thank you very much for your link !! and answer

> if[message]=~ /application/{
>  dissect {mapping => {"message" => "[%{logdate}] %{application}.%{loglevel}: %{logsmessage}"}}
> }
> else{
>  dissect { mapping => { "message" => "[%{logdate}] %{exception}.%{CHttpException}.%{errorcode}.%{loglevel}: %{errormessage}" } }
> }

Could you please tell how to correct enter the condition for message ?
or should I just write if [message ]== application{
}

thank you

4

No, that is a string equality test. You can use a regex, as you have shown, or you can use a sub-string match

if "application" in [message] {
1 Like
5

thank you very much for your answer

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.