Pattern matching in Logstash


(Deepthi V) #1

Hi All,

I am calling Logstash using stdin like shown below:

/opt/logstash/bin/logstash agent -e 'input { file { path => "/home/dv/Desktop/log_output/input/**/*.log" codec => multiline { pattern => "^\s" what => "previous" } start_position => beginning ignore_older => 0 sincedb_path => "/dev/null" } }' -f /etc/logstash/conf.d/pipeline.conf

I am accessing the "path" in my configuration file and I want to check if the "path" contains words like "alerts","var" etc, so that different grok patterns get applied on it.

So far I have tried:

  1. if [path] =~ "alerts"
  2. if "alerts" in [path]

But it does not seem to work. Can anybody please help with this ASAP!

Thanks in advance.

Deepthi


(Magnus Bäck) #2

Please use a stdout { codec => rubydebug } output to show us what your log entries look like. Preferably show us an example that contains "alerts".


(Deepthi V) #3

Hello Magnus,

I was able to resolve this.

Thank you for your reply.

Regards,
Deepthi


(Pradeep G) #4

Hey, Can you tell me how you fixed this issue? thanks


(Deepthi V) #5

It was a silly mistake from my side. I had removed the path field in the filter section but I was trying to access it in the output section. I just corrected that.


(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.