filter {
grok {
match => { "message" => " %{DATA} %{TIMESTAMP_ISO8601:Date}%{DATA}source-address="%{IP:ip_source_address}" source-port="%{NUMBER:source_port}" destination-address="%{IP:ip_destination_address}" destination-port="%{NUMBER:destination_port}" service-name="%{WORD:service_name}" %{DATA} protocol-id="%{NUMBER:protocol_id}" policy-name="%{DATA:policy_name}" source-zone-name="%{DATA:source_zone_name}" destination-zone-name="{DATA:destination_zone_name}" " }
}
}
if you test this on : https://grokdebug.herokuapp.com/ it's ok but in logstash after a configtest i have an error , plz help me
Probably because Logstash is tailing test.log. start_position => "beginning" only matters for new files. Delete the sincedb file or set sincedb_path => "/dev/null". This exact problem is discussed here every week.
Does the logstash user have access to the /var/log/firewall directory? Check your Logstash log for clues. You probably have to turn up the log level at least one notch.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.