Search and filter part of message

Hi,
 I've two separate strings like NAS-EM   ATTACH_REQUEST (0x41)  to be searched in the log file and filter all the messages which has the above strings in the same line and send that data to kibana.
Can you please help me how to write the filter part for the above in logstash config file.
 
Below is the line where we have the above two strings present separately:

000307 Tue Mar 30 09:21:07 2021 7F9ACBCCC700 INFO  NAS-EM tasks/nas/emm/sap/emm_as.c      :0801               EMMAS-SAP - Message Type = ATTACH_REQUEST(0x41) for (ue_id = 1):

Consider below log:
000304 Tue Mar 30 09:21:07 2021 7F9ACBCCC700 INFO  MME-AP tasks/mme_app/mme_app_bearer.c  :0714   [0]   Sending NAS Establishment Indication to NAS for ue_id = (1)
000305 Tue Mar 30 09:21:07 2021 7F9ACBCCC700 INFO  NAS-EM tasks/nas/emm/sap/emm_as.c      :0176               EMMAS-SAP - Received primitive EMMAS_ESTABLISH_REQ (205)
000306 Tue Mar 30 09:21:07 2021 7F9ACBCCC700 INFO  NAS-EM tasks/nas/emm/sap/emm_as.c      :0741                  EMMAS-SAP - Received AS connection establish request
000307 Tue Mar 30 09:21:07 2021 7F9ACBCCC700 INFO  NAS-EM tasks/nas/emm/sap/emm_as.c      :0801               EMMAS-SAP - Message Type = ATTACH_REQUEST(0x41) for (ue_id = 1)
000308 Tue Mar 30 09:21:07 2021 7F9ACBCCC700 INFO  NAS-EM tasks/nas/emm/sap/emm_recv.c    :0183                  EMMAS-SAP - Received Attach Request message

out of which I've to send only below line, as it matched my filter strings:

000307 Tue Mar 30 09:21:07 2021 7F9ACBCCC700 INFO  NAS-EM tasks/nas/emm/sap/emm_as.c      :0801               EMMAS-SAP - Message Type = ATTACH_REQUEST(0x41) for (ue_id = 1):

Please help me in how to write the filter part for this.

Thanks in advance.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.