Yea, figured it out. Now have another problem - can't use my custom patterns:
path: /opt/experimental/logstash_patterns/
in this directory I have 2 subdir, same as pre-defined, just changed some of patterns little bit
my configuration:
grok {
patterns_dir => ["/opt/experimental/logstash_patterns"]
match => { "message" => ["%{CISCOFW104001}","%{CISCOFW104002}","%{CISCOFW104003}", "%{CISCOFW104004}", "%{CISCOFW105003}",
"%{CISCOFW105004}", "%{CISCOFW105005}", "%{CISCOFW105008}", "%{CISCOFW105009}", "%{CISCOFW106001}", "%{CISCOFW106006_106007_106010}",
"%{CISCOFW106014}", "%{CISCOFW106015}", "%{CISCOFW106021}", "%{CISCOFW106023}", "%{CISCOFW106100_2_3}", "%{CISCOFW106100}","%{CISCOFW304001}",
"%{CISCOFW110002}", "%{CISCOFW302010}", "%{CISCOFW302013_302014_302015_302016}", "%{CISCOFW302020_302021}","%{CISCOFW305011}",
"%{CISCOFW313001_313004_313008}","%{CISCOFW313001_313004_313008_custom}", "%{CISCOFW313005}", "%{CISCOFW321001}", "%{CISCOFW402117}", "%{CISCOFW402119}","%{CISCOFW419001}",
"%{CISCOFW419002}", "%{CISCOFW500004}", "%{CISCOFW602303_602304}", "%{CISCOFW710001_710002_710003_710005_710006}","%{CISCOFW713172}", "%{CISCOFW733100}"
]}
}
And parsing doesn't working. What could be the problem? Also tried this path:
/opt/experimental/logstash_patterns/ecs-v1
P.S. Solved it.