[SOLVED] How to filter log from syslog input

Elastic Stack Logstash
1

i have logstash instanse using syslog input plugin for get log from access point .
I try to save log to file (using file output) and i get some line log (json format)

{"tags":["_grokparsefailure_sysloginput"],"message":"<134>VWLAN_Controller: *Dot1x_NW_MsgTask_4: Apr 12 08:53:12.862: #APF-6-USER_NAME_CREATED: apf_ms.c:7761 Username entry (Wifi-Guest) with length (253) created for mobile 18:3a:2d:ca:91:14 ","@timestamp":"2016-04-12T09:00:00.459Z","host":"10.1.6.56","facility":0,"priority":0,"severity":0,"facility_label":"kernel","severity_label":"Emergency","@version":"1"}

I have question : How to filter log above?
After that i used grok filter for filter plantext. But my log is json format and i want to filter "message" only

Thanks

2

How did you solve it?

3

In ssyslog input. i added field

add_field => {
              "type" => "network"
              "beatname"=>"fb-network"
                "beattype"=>"network"
   }

I want log from access point and log from filebeat in same index ( "beatname"=>"fb-network")

After that, I using filter grok ..

if [type] == "network" {
  grok {
    match => { "message" => "grok filter"
  }
}

:smiley: