Pattern matching in Logstash

Elastic Stack Logstash
1

Hi All,

I am calling Logstash using stdin like shown below:

/opt/logstash/bin/logstash agent -e 'input { file { path => "/home/dv/Desktop/log_output/input/**/*.log" codec => multiline { pattern => "^\s" what => "previous" } start_position => beginning ignore_older => 0 sincedb_path => "/dev/null" } }' -f /etc/logstash/conf.d/pipeline.conf

I am accessing the "path" in my configuration file and I want to check if the "path" contains words like "alerts","var" etc, so that different grok patterns get applied on it.

So far I have tried:

  1. if [path] =~ "alerts"
  2. if "alerts" in [path]

But it does not seem to work. Can anybody please help with this ASAP!

Thanks in advance.

Deepthi

2

Please use a stdout { codec => rubydebug } output to show us what your log entries look like. Preferably show us an example that contains "alerts".

3

Hello Magnus,

I was able to resolve this.

Thank you for your reply.

Regards,
Deepthi

4

Hey, Can you tell me how you fixed this issue? thanks

5

It was a silly mistake from my side. I had removed the path field in the filter section but I was trying to access it in the output section. I just corrected that.