#logstash

guys

hello guys,i have a log file -accesslog .can i create an index for a particular field in the log seperatly ?if so how ? please help

log: 10.202.1.5 10.202.5.104:7002 - 2016-11-25 03:28:11.851 0.01 GET /openapi-rest-web/index.html - 200 526 - - - null [corRID::null] [KEY::null] [UID::-]

i want to create a seperate index by the response code : 200 ..when parsing into ES

how do i do that

hello guys

Check the response code and configure a separate index in your output {} config.

I don't see why you need a separate index. You can filter on the response code when querying the index.

can you please specify a sample of how to config in output .

good morning

output { if [your response code] == "200" { elasticsearch { index => "name your index here" } } }

Obviously you must adapt this to your own environment.

ok ..thanks :) @bjorn_

i'am trying to create a new input plugin for logstash. since ruby is quite new to me, i'd really like to debug the provided tests in your pluginbs to get a feeling of how things work. Is there some guidance for doing so? I tried setting everything up in eclipse but the debugger always fails on me

i have set up an rspec task to run the tests. When i do, i end up with an error saying: "SyntaxError: /tmp/dltk58619.tmp/debugger/AbstractRunner.rb:94: syntax error, unexpected tLABEL when nil: NullLogManager.new"

i do not really need to stick to eclipse, i just need something that allows me to step trough the existing plugins to understand them better

hello guys ...for evry entry of a log i need to create two indexes for the log ..how do we implement this in logstash??

Guest41079: I already answered you.

hi guys

anyone using the json filter to "import" some data into logstash?

if yes, how to you access the fields ?

I tried [field] but it doesn't seem to work

if you're not using target => then [field] should conain the value

where 'field' is the name of field as named in json

not using target...

output {

if ![key]{

just doing simple like this

vali: just print out all the fields and see how they look

to see if the fields exist

did it, they are there as expected

not sure it's not picking on the key field..

fixed it ...

my since_db was already at latest point...

and I didn't specify the pos

noob mistake

Hey, anyone know if there are any plans to allow Monitoring API data from Logstash 5.x over to a Marvel/Monitoring cluster?

Does anyone do rsyslog -> RMQ -> LS ?

I'm doing rsyslog -> LS -> RMQ -> LS now, wondering if i can drop the first Ls

doing rsyslog -> kafka -> ls

+ ls -> kafka -> ls -> heroic api