如何使用自定义Logstash grok模式？

Question

I'm using Logstash on Debian 9 and I want to use custom grok patterns. So I've added them to directory /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns - created new files and also modified existing (grok-patterns, auth, etc.).

Problem is that my changes in original files was overwritten and lost (at 02:35 am 12.6.2018).

Is there some automatic updating of logstash-patterns-core ? How can I change existing grok patterns?

Answer 1

Unfortunately, the directory structure where you modified the file is for binaries. You don't need to modify any files at all to add custom patterns. Please have a look at Logstash Directory layout here .

Instead of modifying or adding files under a binary path, you can create a new directory under /etc/logstash , call it a pattern and add your custom patterns there.

You can then import custom patterns as follows,

filter {
    grok {
        patterns_dir => "../patterns"
        match =>["message", "%{ANYPATTERN}" ]
    }
}