Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Filtering specific lines

Tags:

logstash

I am currently trying to filter specific lines from my log file. My lines in the log file are of the following pattern.

[8/05/13 14:24:55.468] RuntimeErrorI E LaError
[8/05/13 14:24:55.468] AbcdEfg W SomeWarning

where the first is the date, time, application name and the Log level( WARNING, ERROR, TRACE etc) followed by the error message or warning message or any other messages.

So what I am trying to get is the log level errors only and not other log levels. I have the following which I am playing around with but I am not getting console output at all. I think I am making a mistake somewhere in my grep for checking if its E(Error)

input {

  file {
  type => "database"
  path => "/home/nakampe/Desktop/file.log"
  }

}

filter {

 grok {

    pattern =>  "[%{MONTHDAY:date} / %{MONTH:month} / %{YEAR:year}  %{TIME:time}] %WORD:application} %{WORD:levelType}  %{WORD:message}"

  }


#Here I want to only consider log levels of E (ERROR) and not others
  grep{

  match => ["levelType", "E"]

  }

}

output {

   elasticsearch { 

   embedded => true 
   }

stdout { 
  message => "%{@message}"
  }     
}  
like image 618
Raymond Nakampe Avatar asked Sep 16 '26 21:09

Raymond Nakampe


1 Answers

 grok { 

pattern =>  "%{MONTHDAY:date}/%{MONTHNUM:month}/%{YEAR:year} %{TIME:time} %{WORD:sast}]      

    %{INT:threadId} %{WORD:applicationName}%{SPACE:space}%{WORD:logLevel} %     {WORD:errorMessage}"

}

My mistake was with the pattern, after debugging using http://grokdebug.herokuapp.com/ all was ok. A very useful tool.

like image 50
Raymond Nakampe Avatar answered Sep 21 '26 14:09

Raymond Nakampe