Logstash has ingest-convert.sh to convert ingest pipelines to Logstash, but I'd like to convert the other way around.

I have the 23-Tomcat-filters and grok_patterns file.

Is there any smart way that would save me time writing all json files to this ingest pipeline-format, based on the current logstash configuration?

PUT _ingest/pipeline/ujjain
  "description" : "Pipeline ujjain",
  "processors": [
      "grok": {
        "field": "message",
        "patterns": ["%{MONTH}%{SPACE}%{MONTHDAY},%{SPACE}%{YEAR}%{SPACE}%{HOUR}:?%{MINUTE}(?::?%{SECOND})%{SPACE}(?:AM|PM)%{SPACE}%{NOTSPACE:class}%{SPACE}%{NOTSPACE:type_log}%{SPACE}%{WORD:loglevel}:%{SPACE}%{GREEDYDATA:log_text}"]


  • 1
    please provide an example of the log file – 030 Apr 1 '18 at 14:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.