How to handle non-matching Logstash grok filters

后端 未结 4 1435
孤街浪徒
孤街浪徒 2020-12-12 20:27

I am wondering what the best approach to take with my Logstash Grok filters. I have some filters that are for specific log entries, and won\'t apply to all entries. The on

4条回答
  •  清歌不尽
    2020-12-12 21:12

    This is the most efficient way of doing this. Ignore the filter

    filter {
    
            grok {
                match => [ "message", "something"]
        }
    
        if "_grokparsefailure" in [tags] {
                drop { }
            }
    }
    

提交回复
热议问题