Setting patterns_dir for grok relatively?

Elastic Stack Logstash
1

Hi,

can the patterns_dir of grok command be set recursively?
How?

Can I set up a default folder / file for patterns, so that there is no need to set them in each grok filter?

Thanks,
Andreas

2

If you create a directory with a document with all of your patterns in it, defining them each with a name then a regex, you can then point to that folder in your grok filter:

i.e. in make a file in folder /etc/logstash/patterns/patterns (can choose any folder to put this in)

<NAME> <REGEX>
EXAMPLE .*
EXAMPLE2 [A-Z]*

   grok {
                patterns_dir => "/etc/logstash/patterns/patterns"
.........
   }
3

Oh, I noticed a wrong translating in my original post / topic.

I did not mean recursively, but I meant relative.
So how can I set the patterns dir relative to the conf folder, where my filters, inputs and outputs are defined?

Can I set a default, so that I can skip naming the pattern directory each time I call grok?
Is there a way to define that patterns_dir by environmental variable?

I am developing locally on windows. Productive system is on linux.

So I have different path structures on both systems. But I don't want need to change all grok patterns directories each time before deploying.

4

Hmmm, not that I know of but you could potentially edit the logstash code itself and add your patterns to the official patterns file. Never done that but that's an option.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.