How to include the filter in Logstash config file?

Question

I am using LogStash which accepts data from a log file, which has different types of logs.

The first row represents a custom log, whereas the second row represents a log in JSON format.

Now, I want to write a filter which will parse the logs on the basis of content and finally direct all the JSON format logs to a file called jsonformat.log and the other logs into a seperate file.

Answer 1

You can leverage the json filter and check if it failed or not to decide where to send the event.

input {
   file {
       path => "/Users/mysystem/Desktop/abc.log"
       start_position => beginning
       ignore_older => 0
   }
}
filter {
   json {
     source => "message"
   }
}
output {
  # this condition will be true if the log line is not valid JSON
  if "_jsonparsefailure" in [tags] {
    file {
       path => "/Users/mysystem/Desktop/nonjson.log"
    }
  }
  # this condition will be true if the log line is valid JSON
  else {
    file {
       path => "/Users/mysystem/Desktop/jsonformat.log"
    }
  }
}