CODEWITHSUNDEEP
logstash
einnocent
einnocent

Reputation: 3974

How to reuse Logstash codec or pattern definition?

Background

Currently in my Logstash configuration, I have something like:

input {
  file {
    type => "catalina-out"
    path => [ "/var/tomcat/logs/catalina.out"]
    sincedb_path => "$HOME/.sincedb"
    tags => ["tomcat", "catalina-out"]
    codec => multiline {
      pattern => "(^.+Exception: .+)|(^\s+at .+)|(^\s+... \d+ more)|(^\s*Caused by:.+)|(%{LOGLEVEL}: %{GREEDYDATA})"
    what => "previous"
    }
  }
...

What I'm trying to accomplish

I have lots of Tomcat output files, and I would like to reuse this codec (or, less optimally, the pattern) with other file definitions.

The problem

My problem is that the following gives me an error:

input {

  tomcat_multiline_codec => multiline {
    pattern => "(^.+Exception: .+)|(^\s+at .+)|(^\s+... \d+ more)|(^\s*Caused by:.+)|(%{LOGLEVEL}: %{GREEDYDATA})"
    what => "previous"
  }

  file {
    type => "catalina-out"
    path => [ "/var/tomcat/logs/catalina.out"]
    sincedb_path => "$HOME/.sincedb"
    tags => ["tomcat", "catalina-out"]
    codec => tomcat_multiline_codec
  }
...

The question

How can I define the codec (or if necessary, the pattern) once, separately from the file block so I can reuse it in other file blocks?

Upvotes: 1

Views: 604

Answers (2)

mp911de
mp911de

Reputation: 18119

You can push the catalina logs also directly to logstash using GELF: http://www.paluch.biz/blog/105-integrating-logstash-with-tomcat-7.html

See also How can I integrate Tomcat6's catalina.out file with Logstash + ElasticSearch + Kibana?

Upvotes: 0

Magnus Bäck
Magnus Bäck

Reputation: 11571

This simply isn't supported. Logstash doesn't have general-purpose variables. Unless you can use a multiline filter your best bet would be to use a configuration management system with templating support to generate and deploy your Logstash configuration files. You shouldn't be maintaining them by hand anyway.

Upvotes: 2

Related Questions