1

Assuming I have a logstash server chocked full of logs being loaded regularly, is there a reasonably elegant way that I can tail the results of a continuously executing query on the logstash server and show this in a terminal window

e.g

some-special-logstash-command.sh | egrep -v "(searchword1|searchword2)"

the idea being that the command pipes stuff out of logstash and to my grep query that filters and shows me the filtered output for.

.. of course if there is a logstash command that can do the grep piece for me as well, then that works too :)

motivation for doing this, is that assuming all of my events from my estate is being loaded into logstash, then would be nice to have a terminal window with a continuous tail of interesting events as they occur scrolling past the screen.

-Ace

  • Your events are being stored in elasticsearch, I presume? – EEAA Jun 11 '14 at 20:30
  • yup - should have mentioned that, sorry. – phatmanace Jun 11 '14 at 20:30
0

Include configuration in your logstash collector to do the grep work and to output to stdout. This is an example using a file input:

input {
  file {
    add_field => ... # hash (optional), default: {}
    codec => ... # codec (optional), default: "plain"
    discover_interval => ... # number (optional), default: 15
    exclude => ... # array (optional)
    path => ... # array (required)
    sincedb_path => ... # string (optional)
    sincedb_write_interval => ... # number (optional), default: 15
    start_position => ... # string, one of ["beginning", "end"] (optional), default: "end"
    stat_interval => ... # number (optional), default: 1
    tags => ... # array (optional)
    type => ... # string (optional)
  }
}
filter {
  grep {
    add_field => ... # hash (optional), default: {}
    add_tag => ... # array (optional), default: []
    drop => ... # boolean (optional), default: true
    ignore_case => ... # boolean (optional), default: false
    match => ... # hash (optional), default: {}
    negate => ... # boolean (optional), default: false
    remove_field => ... # array (optional), default: []
    remove_tag => ... # array (optional), default: []
  }
}
output {
  stdout {}
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.