Setting patterns_dir for grok relatively?



can the patterns_dir of grok command be set recursively?

Can I set up a default folder / file for patterns, so that there is no need to set them in each grok filter?


(Kofi) #2

If you create a directory with a document with all of your patterns in it, defining them each with a name then a regex, you can then point to that folder in your grok filter:

i.e. in make a file in folder /etc/logstash/patterns/patterns (can choose any folder to put this in)


   grok {
                patterns_dir => "/etc/logstash/patterns/patterns"


Oh, I noticed a wrong translating in my original post / topic.

I did not mean recursively, but I meant relative.
So how can I set the patterns dir relative to the conf folder, where my filters, inputs and outputs are defined?

Can I set a default, so that I can skip naming the pattern directory each time I call grok?
Is there a way to define that patterns_dir by environmental variable?

I am developing locally on windows. Productive system is on linux.

So I have different path structures on both systems. But I don't want need to change all grok patterns directories each time before deploying.

(Kofi) #4

Hmmm, not that I know of but you could potentially edit the logstash code itself and add your patterns to the official patterns file. Never done that but that's an option.

(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.