4

I'm trying to use the grep function, but it not works,

this is the error :

Couldn't find any filter plugin named 'grep'. Are you sure this is correct?    
Trying to load the grep filter plugin resulted in this error: no such file to 
load -- logstash/filters/grep

and this is my file logstash.conf

input {
stdin { }
file {
type => "FireWall"
path => "/var/log/test.txt"
start_position => 'beginning'
}
}
filter {


grep {

    match =>["message",".* Morito .*"]
 }
grok {

patterns_dir => "./patterns"
   match => [
    "message", "%{WORD:firstname} %{WORD:lastname} %{NUMBER:age}    
]
}
}
output {
stdout { }
elastic search {
cluster => "logstash"
}
}

What should i do please ?

1 Answer 1

4

grep{} was dropped in favor of conditionals and drop{}:

if [message] =~ /regexp/ {
     drop{}
}
1
  • "The 'grep' plugin is no longer necessary now that you can do if/elsif/else in logstash configs. This plugin will be removed in the future. If you need to drop events, please use the drop filter. If you need to take action based on a match, use an 'if' block and the mutate filter. See the following URL for details on how to use if/elsif/else in your logstash configs:logstash.net/docs/#{LOGSTASH_VERSION}/configuration"
    – Morito
    Commented Apr 14, 2015 at 7:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.