CODEWITHSUNDEEP
logstashlogstash-grok
user1077071
user1077071

Reputation: 961

Logstash and Grok filter failure

My log file has a single line (taken from the tutorial log file):

55.3.244.1 GET /index.html 15824 0.043

My conf file looks something like this:

input {
  file {
    path => "../http.log"
    type => "http"
  }
}

filter {
  grok {
    type => "http"
    match => [ "message", "%{IP:client}" ]
  }
}

I tested my grok filter with the grok debugger and it worked. I'm at a loss of what I am doing wrong. I get a [0] "_grokparsefailure" every time

Upvotes: 0

Views: 365

Answers (1)

user3195649
user3195649

Reputation: 437

As far as debugging a grok filter goes, you can use this link (http://grokdebug.herokuapp.com/) It has a very comprehensive pattern detector which is a good start.

If you only care about the IP and not the remainig part of the log message, following filter should work for you.

%{IP:host} %{GREEDYDATA:remaining_data}

The best method to debug is use, stdin and stdout plugins for logstash and debug your grok patterns.

You can find the documentation here http://logstash.net/docs/1.4.2/

Upvotes: 2

Related Questions