Logstash Tips and Tricks

There are a few tips related to Logstash, which are described in the following sections.

Referencing fields and Its values

In the Logstash configuration file, you can refer to a field by its name and can subsequently pass the value of a field into another field. If you want to refer to a top-level field, use the field name directly. If you want to refer to a nested field, use the [top-level field][nested field] syntax. To refer the field, Logstash uses the sprintf format, which helps us to refer to the field values.

The sprintf format is as follows:

%{[top-level field][nested field].....} 

For example:

output {   
        elasticsearch { 
                document_type => "%{@version}" 
                index => "logstash_%{type}_%{+YYYY-MM-dd-H}" 
  } 
} 

Note

The index name cannot contain the following special characters: \, /, *, ?, ", <, >, |, or ,. Also, the index name must be in lowercase only.

Adding custom-created grok...