0

I have the following problem: I am new to logstash and I am trying to simply transfer information from one .log file to another. My config file looks like this and logstash is currently running on Windows 10.

input {
file {
    path => "C:/Downloads/Test/input.log"   
    sincedb_path => "NUL"
    start_position => "beginning"
    ignore_older => 0
}   
}

output {

file {
    path => "C:/Downloads/Test/output.log"
}
}

The input file looks like this.

INFO 2018-11-12 13:47:22,378 [AGENT] - [KEY] [METHOD] MESSAGE

The next step would be applying a filter to only transfer the ERROR lines to the output file using a grok filter.

Can anyone help me please?

P.Lang
  • 1
  • 1
  • What sort of filter have you tried? – Alain Collins Nov 27 '18 at 21:29
  • I had no filter in there. Only in- and output was used. – P.Lang Dec 10 '18 at 12:51
  • Most on SO won't complete your project for you, but will help you correct errors, etc. Take a look at the logstash filters, and see if one of them stands out as helping you to limit which messages are send to ES. If you have trouble implementing that filter, update your post with what you've tried. – Alain Collins Dec 10 '18 at 19:37

0 Answers0