How to handle inconsistent Logstash grok filters

Question

I am wondering what works best for my Logstash Grok filters. I have some filters that are for specific journal entries, and will not apply to all entries. Those that are not applicable always generate _grokparsefailure tags. For example, I have one grok filter that works fine for each log entry. Then I have another filter, which is for tracking error messages. The trace filter returns a grokparsefailure for each journal entry that does not have a trace.

I would prefer it to simply pass the rule if there is no match instead of adding the parsefailure tag. I use the parsefailure tag to find things that don't parse correctly, and not things that just don't match a specific filter. Maybe this is just the nomenclature of "failure to parse" that bothers me. For me, this means that something is wrong with the filter (for example, poorly formatted), and not that it does not match.

So the question is, how should I handle this?

• Make the filter pattern optional using?

• (ab) use the tag_on_failure parameter, setting it to nothing []

• make the filter conditional using something like "if traceback in message"

• something else I do not consider?

Thanks in advance.

EDIT

I took the way to add conditions around the filter:

if [message] =~ /took\s\d+/ { grok { patterns_dir => "/etc/logstash/patterns" match => ["message", "took\s+(?<servicetime>[\d\.]+)"] add_tag => [ "stats", "servicetime" ] } } 

However, he is interested in feedback. What is considered "best practice" here?

Answer 1

When possible, I would include a conditional shell like the one you are using. Feel free to post this as an answer!

If your application creates only a few different line formats, you can use several matching patterns with grok filter . By default, the filter will process until the first successful match:

 grok { patterns_dir => "./patterns" match => [ "message", "%{BASE_PATTERN} %{EXTRA_PATTERN}", "message", "%{BASE_PATTERN}", "message", "%{SOME_OTHER_PATTERN}" ] } 

If your logic is less simple (maybe you need to check the same condition more than once), grep filter can be useful for adding a tag. Something like that:

 grep { drop => false #grep normally drops non-matching events match => ["message", "/took\s\d+/"] add_tag => "has_traceback" } ... if "has_traceback" in [tags] { ... } 

Answer 2

You can also add tag_on_failure => [] to your stanza, for example:

 grok { match => ["context", "\"tags\":\[%{DATA:apptags}\]"] tag_on_failure => [ ] } 

grok will still fail, but will do so without adding an array of tags.

Answer 3

You can also do it

remove_tag => ["_grokparsefailure"]

whenever you have a match.

Answer 4

This is the most effective way to do this. Ignore filter

 filter { grok { match => [ "message", "something"] } if "_grokparsefailure" in [tags] { drop { } } }