text logstash_conf

Posted 2021-05-01

input {
	  file {
		      path => "/tmp/*.log"
	}
}

filter {
	if [message] =~ /ERROR/ {
			mutate {
				copy => { "path" => "path_tmp" }
			}
			mutate {
				split => { "path_tmp" => "/" }
			}
	                mutate {
				 replace => { "message" => "%{[path_tmp][1]}_%{message}"  }
			}
			mutate {
				 remove_field => [ "path_tmp" ]
			}
	}
								    
}

output {
	  slack {
		      url => "https://hooks.slack.com/services/xx/xx/xx"
		          format => "[Test !] %{message}"
			    }
	    # stdout { codec => rubydebug }
}