Syntax in filter Error log

[juuuhuuu (XJ)]

Hi

I am a bit struggling with the syntax in logstash. I would like to filter Log Level -Error.
In my .log I have something like timestamp applicationtest.Error messsage. Is it possible that i my errorlog I will see applicationtest.Error or just ERROR

I am using Grok filter:

grok{
match => {"message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:log-level}-%{GREEDYDATA:message}"}
}

but I can not see the Error log.

Thank You

[andres-perez (Andrés Pérez)]

Hi,

please add examples of the exact log lines that you are using as input and the expected results that you want.

Probably some tests in https://grokdebug.herokuapp.com/ will help you to get your match patterns right.

[juuuhuuu (XJ)]

Thank you for your reply.

[juuuhuuu (XJ)]

log lines is : [2020-01-03 11:16:50] applicationtest.ERROR: message ahoj jak se mas

[Badger]

You could dissect that

dissect { mapping => { "message" => "[%{timestamp}] %{something}.%{loglevel}: %{errormessage}" } }

[juuuhuuu (XJ)]

thank You very much .. ill try it