I have following pattern file.
CPAT ([\w-]+)
FRDOM ([\w-]+)
DEVC ([\w]+)
I had given permission for pattern file. but it gives the following error.
Pipeline aborted due to error {:exception=>#<Grok::PatternError: pattern %{CPAT:devicename} not defined>
my filter is like this.
grok{
patterns_dir => ["/etc/logstash/pattern.d"]
match => { "message" => "%{CISCOTIMESTAMP:timestamp} %{IP:serverip}.%%{DEVC:dev}.%{DEVC:devnum}.%{DEVC:status}: Device('%{CPAT:devicename}'/'%{CPAT:device}'/%{CPAT:devicemac}. at %{FRDOM:dom}.'%{FRDOM:rfdomain}" }
}