Short Example of Logstash JSON Filter

README.md

Short Example of Logstash JSON Filter

Logstash

pushd $THIS_GIST_DIR
test -d data || mkdir data
test -d logs || mkdir logs
logstash --path.settings $THIS_GIST_DIR --path.logs $THIS_GIST_DIR/logs --path.data $THIS_GIST_DIR/data -f $THIS_GIST_DIR/pipeline.config

Filebeat

filebeat -c filebeat.yml

filebeat.yml

filebeat.inputs:
- type: log
  paths:
    - info.log
output.logstash:
  hosts: ["localhost:5044"]

info.log

{"message":{"args":[],"rss":27086848,"heapTotal":11902976,"heapUsed":7414104,"external":42479},"level":"info","timestamp":"2018-08-30T04:55:10.898Z"}
{"message":{"args":["hello"],"rss":27086848,"heapTotal":11902976,"heapUsed":7412448,"external":42479},"level":"info","timestamp":"2018-08-30T04:55:13.859Z"}
{"message":{"args":["hello","world"],"rss":27070464,"heapTotal":11902976,"heapUsed":7415048,"external":42479},"level":"info","timestamp":"2018-08-30T04:55:16.202Z"}
{"message":{"args":["bye"],"rss":27107328,"heapTotal":11902976,"heapUsed":7414056,"external":42479},"level":"info","timestamp":"2018-08-30T04:55:20.380Z"}

pipeline.config

input {
    beats {
        port => "5044"
    }
}
filter {
    json {
        source => "message"
    }
}
output {
    stdout { codec => rubydebug }
}