Logstash dynamic create field from configuration

0
votes

I tried to create dynamic the path from one filter but i get the error, when i try to start logstash. The field service is send from logstash and i can see it on kibana.

Is not environment variable that i want. I want a field from logstash, when beat send to logstash.

Example:

Beat send data with: field: service , data: apache

logstash: 

filter {
  data_dictionary_path => '/var/log/apache/data.log'
}

Any ideas ? :)

Config file:

filter {
  data_dictionary_path => '/var/log/${service}/data.log'
}

Error msg:

:message=>"No such file or directory - /var/log/${service}/data.log", :backtrace=>["org/jruby/RubyFile.java:366:in `initialize'",
2
logstashlogstash-configuration

2 Answers

0
votes

In .bashrc file, set the environment variable as below

export SERVICE=/var/log/continuining_path

In config file

filter {
   data_dictionary_path => "${SERVICE}/data.log"
}
0
votes

Did you try the grok filter?

grok {
match => { "data_dictionary_path" => "/%{GREEDYDATA}/%{GREEDYDATA}/%{GREEDYDATA:service}/%{GREEDYDATA}" }
      }