Search code examples
logstashlogstash-grokgrok

logstash grok pattern to monitor logstash itself

I would like to add logstash.log log into my ELK stack but I always have grokparsefailure. My pattern is OK on http://grokconstructor.appspot.com/do/match#result Test grok pattern OK

My logstash conf file (filter part) is 

filter {
  if [application] == "logstash" {
    grok {
      match => { "message" => "\{:timestamp=>\"%{TIMESTAMP_ISO8601:timestamp}\", :message=>%{GREEDYDATA:errormessage}\}" }
    }
    date {
      match => [ "timestamp" , "yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ" ]
    }
  }
}

But still In only get 

{
  "_index": "logstash-2016.05.03",
  "_type": "logs",
  "_id": "AVR3WUtpT8BPcJ-gVynN",
  "_score": null,
  "_source": {
    "@version": "1",
    "@timestamp": "2016-05-03T16:00:20.708Z",
    "path": "/var/log/logstash/logstash.log",
    "host": "xxx.arte.tv",
    "application": "logstash",
    "tags": [
      "_grokparsefailure"
    ]

I guess I have issue with either { ou " but with or without backslashing theim, still grokparsefailure.

Solution

  • Shame on me, there is no error in my previous post, problem was no message because of a remove_field message in another conf file.

    Sorry guys for the waste of time