Getting Started With Logstash Filters

Viewed 25808

Looking for a little help getting started... I have Logstash installed (as well as ElasticSearch) but I'm struggling with my first filter.

As a test I have it configured to read from a trimmed log file that contains 6 lines, each line begins with a time stamp such as [11/5/13 4:09:21:327 PST] followed by a bunch of other data.

For now I have my conf file set to read this file and I'm trying to do a very basic grok filter to match the lines, maybe to grab the timestamp and then the rest of the data (from where I can start splitting it up).

Here is what I have:

input {
  file {
    type => "chris"
    path => "/home/chris/Documents/test.log" 
  }
}
filter {
  grok {
    type => "chris"
    pattern => "%{GREEDYDATA:logline}"
  }
}
output {
  stdout {debug => true debug_format => "json"}
}

I was kind of expecting (hoping) that when I ran Logstash it'd match each line and output it, then I could start breaking the lines down and filtering my adjusting the pattern but as I can't get this first basic bit to work I'm a little stumped.

Does anyone have a similar conf file they'd be okay to share? Most of the examples I can find are more advanced and I seem to be stuck trying to get out of the gate.

Thanks,

Chris.

1 Answers
Related