From the course: Learning the Elastic Stack (2020)

Unlock the full course today

Join today to access over 22,500 courses taught by industry experts or purchase this course individually.

Solution: Interactive Logstash

Solution: Interactive Logstash - Elastic Stack Tutorial

From the course: Learning the Elastic Stack (2020)

Start my 1-month free trial

Solution: Interactive Logstash

“

(upbeat music) - [Instructor] One thing that you probably ran into right away in this interactive session is that it doesn't let you use the arrow keys to edit the log line. So if I started typing something here and then I, you know, was trying to match my log line, oh wait, I want to go back, well, then it puts in these strange control characters. And you can use the backspace, but if you break across a line, at least in git bash, it doesn't work. So let me back all the way up. So the easiest way to do this is to actually just edit things in another text editor in another window. So let me start with that log line we just pasted in, and I'm just going to copy it and I'll paste it down below here. Now, reading through the grok matcher, we can see there's a timestamp, which is this, and then /s+, so that means one or more spaces, there's a few, then there's a duration, which matches the second matcher here. And we have an IP address, and then there's a cache result, which is just a…

Contents