NLS Log from file not working

[jolson]

No problem! If you have any follow up questions I'd be happy to answer them. Glad we got this working.

[kconti]

Yeah It doesn't like your filter it seems - but I'll use that grok tool to try to come up with something.

[jolson]

At this point my filter would likely need some re-doing.

I hope that you have enough information to define your own filter - let me know if you have questions though. Thanks!

[kconti]

Yes, you have been more than helpful, thanks so much!

I did get the all the other fields to finally populate (besides message) by altering your match:
Old:
match => [ "message", "^<%{NUMBER:number}>.....etc
New:
match => [ "message", "%{NUMBER:number}>.....etc

This messed up the first field partition - but I didn't need that field anyway.

Have a great weekend!

[jolson]

No problem - thanks for reporting back.

Have a great weekend!

You too.