kibana 4 - Logstash:Filter configuration for multiline log -
i trying parse multi line log using logstash. log looks below
==> /var/log/mail/log/alerting.log <== 2016/01/30 08:40:29 , worker_1 , {u'name': u'high', u'type': u'alert', u'alertid': 1122, u'queue_in_time': u'2016-01-30 08:40:29', u'path': u'/var/log/mail/log/alert.log'} but not sure how set configuration file. config file looks :
input { file { path => "/logs/var/alerts.log" type => "queue" start_position => "beginning" codec =>multiline{ pattern => "==>" negate => true => previous } } } filter { if [type] == 'application'{ date { match => [ "timestamp" , "yyyy/mm/dd hh:mm:ss" ] } } } output { stdout { } } can tell me how configure filter kind of logs ? new elk stack , not able understand how configure config file parsing custom logs.
Comments
Post a Comment