Using logstash, How to filter Errors only from logs?

Elastic Stack Logstash
1

Hi, I am using logstash in our project, How to filter Errors only from logs ?

i am using below configuration:

input {

file {
path => "D:/apache-tomcat-7.0.67/logs/cpe.log"
start_position => "beginning"
}
}

filter {
grok {
match => { "message" => "%{APACHEERRORLOG}" } #it wont worked for me
}
}

output {
elasticsearch {
hosts => ["localhost:9200"]
}
stdout { codec => rubydebug }
}

2

How to filter Errors only from logs ?

It's not clear what this means.

it wont worked for me

What does this mean? Please be explicit. What's the input? What's the actual result? What's the expected result?

3

input is log file containing loglevels INFO, ERROR.
i want logs output to be filtered only ERROR loglevels.
below configuration results : pattern %{APACHEERRORLOG} not defined
filter {
grok {
match => { "message" => "%{APACHEERRORLOG}" } #it wont worked for me
}
}

what should be configuration so that i can see only ERROR logs filtered in output.

4

input is log file containing loglevels INFO, ERROR.
i want logs output to be filtered only ERROR loglevels.

Either wrap the output in a conditional that look at the field containing the log level,

if [level] == "ERROR" {
  output {
     ...
  }
}

or use a similar conditional that wraps the drop filter (which deletes the current event). See Accessing event data and fields | Logstash Reference [8.11] | Elastic.

below configuration results : pattern %{APACHEERRORLOG} not defined

AFAICT Logstash doesn't ship with pattern with that name. I don't know where you got that pattern name from. However, it does ship with a few other patterns that might be useful to you:

5

Thanks this solved my problem.

6

Hi community,
i have a log like :17:37:17,103 ERROR [org.apache.catalina.core.ContainerBase.[jboss.web].[default-host].....rest of text.
what is the convenient grok to filter that.
Any help is appreciate.

7

@baha1, please start a new thread for your unrelated question.

8

thank you for answering,this is the link of the new thread.

9

i am also have same issue. i want save the only errors in formation for that which filter i need to use

10

i am also have same issue. i want save the only errors in formation for that which filter i need to use

Then start a new thread (topic) for your question, and include more details about your configuration and your requirements. The more specific question you ask the more specific and exact replies you'll get.