Search code examples
filterlogstashsyslog

Logstash config, “if message contains…”

So, let's assume that I have a portion of a log line that looks something like this:

Dec 11 13:59:17 172.00.1.00 NPF_OLT_LAB05: clear service affecting Alarm for ONT "100002" at 2019/12/11 13:59:17.28: "ONT Dying Gasp"

And I have to create a filter that does something like this

filter {
  if ([message]) =~ "NPF_OLT_LAB05"{
   grok{
      match => { "message" => "%{SYSLOGBASE} %{WORD:Alarm_Severity} %{DATA:Message} %{QS:ONT_ID} %{DATA:Time} %{QS:ONT_Message}" }
   }
 }
}

Is this possible?

Solution

  • check with below configuration,

    filter {
  if "NPF_OLT_LAB05" in [message] {
   grok{
      match => { "message" => "%{SYSLOGBASE} %{WORD:Alarm_Severity} %{DATA:Message} %{QS:ONT_ID} %{DATA:Time} %{QS:ONT_Message}" }
   }
 }
}