Multiple log in input, how to filter one by one?

Elastic Stack Logstash
1

Hi, Im a beginner with ELK and I want to apply different filter on my log.
This is my input file :
input {
beats {
type => log
port => 5044
host => 0.0.0.0
}
}
With this file, we listen on port 5044, from everywhre, and each log we received on this port will have the log type. Are we ok ?

Now if i receive Apache log on this port, and Syslog too for example, how can I filter filter them. I mean how in the filter I can take only apache log, or only log file ?

And when I used filebeat modules, should I have to create by my self a filter file ?

Sorry for bad english and thank you.

2

This thread has an example of making adding fields to a record in filebeat and using conditionals in the filter in logstash.

3

Hi and thanks.

When I have this input :

filebeat.inputs:
- type: log
  paths:
    - /var/log/auth1.log
  fields:
    log_type: auth1
  fields_under_root: true
- type: log
  paths:
    - /var/log/auth2.log
  fields:
    log_type: auth2
  fields_under_root: true

My filter file will start like :
filter {
if [log_type] == "auth1" {
grok { blabla }
}
}

This will be ok ?

4

That looks right, yes.

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.