Re: Input type is getting Grokked even when the filter is of
Posted: Thu Jun 09, 2016 10:35 am
Score! I'll leave this thread open for now, let us know if you see any further issues.
Sorry, I was out of office for a few days. However, this isn't resolved as of yet. We're just not seeing the logstash.log get flooded at this point (though it still is getting some hits, we will worry about that at another time). We are still having issues described in the title of this post.
Our input filter is not performing a grok statement on anything of the type "IIS_requests" (again, an input type we created and that is coming in correctly). However, these log types are still being displayed with the grok filter we originally created for this content type, which means that while it is basically we working, we can't change or correct anything as it stands now. I will be opening a proper support ticket once support hours roll around and update with any findings.