i want read logs after particular date. approach drop events previous date. try achieve this:
i dropping logs before june 1, 2015:
logstash config file:
input { file{ path => [ "/var/log/rsyslog/**/*.log" ] } } filter { grok { match => ["path", "/var/log/rsyslog/(?<server>[^/]+)/%{year:year}-%{monthnum:month}-%{monthday:month_day}/(?<logtype>.*).log"] } if [year] < "2015" , [month] < "6" , [month_day] < "1" { drop { } }
my logstash.err file keeps printing this:
could not load : can't convert nil string
any idea why?
one of 3 values - year, month or month_day nil. because regex not matching of lines in log file.
Comments
Post a Comment