Hi all, I have a problem to start logstash i think that the cause is my logstash.conf,
input {
udp {
port => 5000
codec => json
}
}
filter {
if [docker][image] =~ /^rancher/ or [docker][image] =~ /^bekt/ {
drop { }
}
mutate {
remove_field => [ "stream","tags"]
gsub => ["message", "\u001b", ""]
gsub => ["message", "[[0-9][0-9]m", ""]
gsub => ["message", "[\]", ""]
}
grok {
match => {
"message" => "%{TIMESTAMP_ISO8601:date}](\s\s|\s)%{LOGLEVEL:logtype}: %{GREEDYDATA:header}(:\s|++++:|\s=\s)(%{GREEDYDATA:content}(reqId=%{GREEDYDATA:trasactionId})|%{GREEDYDATA:content})" }
}
split { field => "content" }
if [message] =~ "{"topic":" {
grok {
match => { "message" => "{"topic":%{QS:topic}"}
}
}
}
output {
elasticsearch {
hosts => ["elasticsearch:9200"]
}
stdout { codec => rubydebug }
}
I cant find the mistake, could someone help me please?.