Redis Module - Assign keys based on message content

Elastic Stack Beats
1

How can I create a key setting that will check if a log message contains a string and outputs to a specific redis key? I was thinking something like this

output.redis:
  hosts: ["localhost"]
  keys:
    - key: "info_list"
      when.contains:
        message: "INFO"
    - key: "debug_list"
      when.contains:
        message: "DEBUG"

My understand of this example is it is suppose to check the line it receives from a log file and apply a corresponding key (i.e. if the message is "This is a DEBUG message" then the message will be saved to redis under the DEBUG key). However in my experience this isn't what is happening, it is simply not saving the messages to any key.

2

Still seeing the same behavior, do I need to do more configuration before filebeat can filter based on message content?

3

Can you check if any data is stored under filebeat, the default key. But if message aren't being published at all then check the Filebeat log output for issues. You might even want to enable debug logging if you don't find any errors (logging.level: debug).

Well debug_list rather than DEBUG.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.