Using Grok fields in stdout


My goal is to be able to stdout a message that uses the fields I have creating using Grok.

I have pasted my output code for my config file. The way I am currently trying is not working. I'm not entirely sure what the output in the console is a result of.

output {
  if "_grokparsefailure" not in [tags] {
    elasticsearch {
        hosts => ["cii6w760:9201"]
  if "no_matching_pattern" in [tags] {
    stdout { codec => line {
      format => "message: %{message}"  

%{message} is one of the fields I created using the Grok plugin

Here is the output in the console:

Thank you for your help! If there is any other code you need to see I am glad to post it.

  • Miranda

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.