Search code examples
logstashlogstash-grok

Logstash if field contains value

I'm using Filebeat to forward logs into Logstash. I have filenames that contain "v2" in them, for an example:

C:\logs\Engine\v2.latest.log

I'd like to perform a different grok on these files. I tried both of the following:

filter{
   if "v2" in [filename] {
          grok {
            .....
            .....
          }

   }
 }

OR

    filter{
           if [filename] =~ /v2/ {
                  grok {
                    .....
                    .....
                  }

           }
     }
Solution

  • Well, my issue was that the "Filename" field was being generated AFTER the filter. So my syntax was correct but it simply was not catching anything because it didnt exist. However, Starting from version 6.7 they've added a "log.file.path" field which is the "Filename" field I previously generated.