How to `grok` the logstash formatted log in logstash?
Closed this issue · 2 comments
chintanp commented
I am trying to write a filter for the logstash formatted log in logstash. The current message string is:
{"@message":"1 users connected","@timestamp":"2020-04-02T00:10:17.871Z","@fields":{"level":"info"}}
I tried using
else if [fields][log_type] == "city_dashboard_logs" { json { source => “message” target => “message” } }
but this did not work.
Any suggestions?
c-vetter commented
There is no magic to the format of logstash, it's simple JSON. There is no field log_type
in your sample message, therefore you cannot filter on it. If you expect that, you need to find the reason it's missing. Please close this issue as there is nothing to be done within logform
.
chintanp commented
@rasenplanscher Yes, thanks. Seems like a rookie mistake now.