Write data that have failed in Logstash filter transforms to file

[Tomo_M (Tomohiro Mitani)]

This post help you?

Logstash Handling Filter Errors

Errors are saved in an array named tags. For example Grok will add _grokparsefailure to that tag when something happens. Then you can do your error handling from that. if "_grokparsefailure" in [tags] { # do something } _grokparsefailure documentation _mutate_error The tag_on_failure option is what you are looking for and you can set it to what you want or use the defaults.