Setting patterns_dir for grok relatively?


can the patterns_dir of grok command be set recursively?

Can I set up a default folder / file for patterns, so that there is no need to set them in each grok filter?


If you create a directory with a document with all of your patterns in it, defining them each with a name then a regex, you can then point to that folder in your grok filter:

i.e. in make a file in folder /etc/logstash/patterns/patterns (can choose any folder to put this in)


   grok {
                patterns_dir => "/etc/logstash/patterns/patterns"

Oh, I noticed a wrong translating in my original post / topic.

I did not mean recursively, but I meant relative.
So how can I set the patterns dir relative to the conf folder, where my filters, inputs and outputs are defined?

Can I set a default, so that I can skip naming the pattern directory each time I call grok?
Is there a way to define that patterns_dir by environmental variable?

I am developing locally on windows. Productive system is on linux.

So I have different path structures on both systems. But I don't want need to change all grok patterns directories each time before deploying.

Hmmm, not that I know of but you could potentially edit the logstash code itself and add your patterns to the official patterns file. Never done that but that's an option.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.