Top "Logstash-grok" questions

Grok is an abstraction on top of regular expressions to allow easy parsing of unstructured text into structured and queryable form.

How do I match a newline in grok/logstash?

I have a remote machine that combines multiline events and sends them across the lumberjack protocol. What comes in is …

regex logstash logstash-grok
Logstash optional fields in logfile

I'm trying to parse a logfile using grok Each line of the logfile has fields separated by commas: 13,home,ABC,…

regex logstash logstash-grok
Parse Apache2 Error logs with Grok for Logstash

Im trying to parse my apache2 error log and im having a bit of trouble.. It doesnt seem to be …

apache apache2 logstash logstash-grok
logstash _grokparsefailure issues

I'm having issues with grok parsing. In ElasticSearch/Kibana the lines I match come up with the tag _grokparsefailure. Here …

logstash logstash-grok
Logstash custom date log format match

I have this log that print the date format that looks like this: = Build Stamp: 10:45:33 On Apr 4 2014 = So i have …

logstash logstash-grok
logstash if statement within grok statement

I'm creating a logstash grok filter to pull events out of a backup server, and I want to be able …

logstash logstash-grok
Debugging new logstash grok filters before full use

I have been following this guide: http://deviantony.wordpress.com/2014/06/04/logstash-debug-configuration/ Which I'm hoping will help me test my logstash …

logstash logstash-grok
Logstash config, "if string contains..."

So, let's assume that I have a portion of a log line that looks something like this: GET /restAPI/callMethod1/8675309 …

logstash logstash-grok logstash-configuration
Grok pattern for different types of log in a logfile

I am trying to write grok pattern for my log file which has three different types of logs, I want …

logstash logstash-grok
Parse multiline JSON with grok in logstash

I've got a JSON of the format: { "SOURCE":"Source A", "Model":"ModelABC", "Qty":"3" } I'm trying to parse this JSON using …

json elasticsearch logstash logstash-grok