Parsing different messages using different filters

Hello, I have the following log-file:

2017-01-01 07:53:44 [connectionpool.py] DEBUG: "POST /api/v1/crawledproducts/merchant/ariika/new_crawl_iteration/ HTTP/1.1" 200 None
2017-01-01 07:53:44 [monitor_utils.py] INFO: Crawled iteration for merchant ariika started
2017-01-01 07:53:44 [utils.py] INFO: UpdateCrawlIteration._start_crawl_iteration function took 0.127 s
2017-01-01 07:53:44 [telnet.py] DEBUG: Telnet console listening on 127.0.0.1:33357
2017-01-01 07:57:22 [statscollectors.py] INFO: Dumping Scrapy stats:
{'item_scraped_count': 22,
 'invalid_items_count': 84}

I want to extract the merchant name ariika from the second line and each of the last 2 lines (scraped_items, invalid_items)

I wrote a filter for each which was working fine its own, but when I added the 2 filters together it didn't work, here is my logstash.conf

input {
    tcp {
        port => 5000
        codec => multiline {
            pattern => "^%{TIMESTAMP_ISO8601} "
            negate => true
            what => previous
        }
    }
}

filter {
        # Merchant name
	grok{
		match => [ "message", "(?<merchant_name>(?<=Crawled iteration for merchant ).*(?= started))" ]
	}
}

filter{
	# Scraped items, invalid items
	grok{
		match => [ "message", "'item_scraped_count': %{NUMBER:scraped_items:int}" ]
	}
	grok{
		match => [ "message", "'invalid_items_count': %{NUMBER:invalid_items:int}" ]
	}
}

output {
	stdout {
		codec => rubydebug
	}
}

How can I edit my configurations to extract the needed info from the logfile?

fixed using conditions

filter {

	if "Dumping Scrapy stats" in [message] {

		## Scraped items, invalid items
		grok{
				match => [ "message", "'item_scraped_count': %{NUMBER:scraped_items:int}" ]
		}
		grok{
				match => [ "message", "'invalid_items_count': %{NUMBER:invalid_items:int}" ]
		}
		}

	else{
		grok{
				match => [ "message", "Crawled iteration for merchant %{WORD:merchant_name} started" ]
			}
		}
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.