Please help with grok pattern

Elastic Stack Logstash
8

Well... I got it!

It does not work with patterns_dir => "'"/etc/logstash/conf.d/patterns

[root@de2log01p ~]# cat /tmp/test.log | sudo -u logstash /usr/share/logstash/bin/logstash -e 'input { stdin {} } filter { grok { patterns_dir => "'"/etc/logstash/conf.d/patterns"'" match => { "message" => "%{NGINX_ACCESS_UPSTREAM}"}} } output { stdout { codec => rubydebug }}'

{
      "@version" => "1",
          "host" => "elk.server",
    "@timestamp" => 2018-03-14T10:38:48.324Z,
       "message" => "\"12/Mar/2018:07:45:23 +0000\"; \"91.198.36.14\"; \"UA:-:-\"; \"10.10.10.1:80\"; \"200\"; \"0.000 sec\"; \"0.003 sec\"; \"www.some-site.ua\"; \"GET /services/ HTTP/1.1\"; \"327\"; \"https://www.some-site.ua/services/\"; \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.76 Safari/537.36\"",
          "tags" => [
        [0] "_grokparsefailure"
    ]
}

Everything is OK with patterns_dir => "'"/etc/logstash/conf.d/patterns/nginx

[root@de2log01p ~]# cat /tmp/test.log | sudo -u logstash /usr/share/logstash/bin/logstash -e 'input { stdin {} } filter { grok { patterns_dir => "'"/etc/logstash/conf.d/patterns/nginx"'" match => { "message" => "%{NGINX_ACCESS_UPSTREAM}"}} } output { stdout { codec => rubydebug }}'

{
                     "agent" => "\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.76 Safari/537.36\"",
             "upstream_addr" => "10.10.10.1",
        "nginx_http_request" => "GET",
        "nginx_request_desc" => "/services/",
        "nginx_http_version" => "1.1",
                   "message" => "\"12/Mar/2018:07:45:23 +0000\"; \"91.198.36.14\"; \"UA:-:-\"; \"10.10.10.1:80\"; \"200\"; \"0.000 sec\"; \"0.003 sec\"; \"www.some-site.ua\"; \"GET /services/ HTTP/1.1\"; \"327\"; \"https://www.some-site.ua/services/\"; \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.76 Safari/537.36\"",
                 "http_host" => "www.some-site.ua",
           "upstream_status" => "200",
                  "referrer" => "https://www.some-site.ua/services/",
                "@timestamp" => 2018-03-14T10:39:13.827Z,
     "upstream_connect_time" => "0.000",
                     "bytes" => "327",
                  "clientip" => "91.198.36.14",
                  "@version" => "1",
                      "host" => "elk.server",
    "upstream_response_time" => "0.003",
                 "timestamp" => "12/Mar/2018:07:45:23 +0000",
             "upstream_port" => "80"
}