title: Filtering specific lines from log file in logstash
body: <p>I am not able to get specific lines from logs file /var/log/messages. I am using logstash-forwarder in client-server and logstash, elasticsearch and kibana in log-server. I tried to install <a href="http://logstash.net/docs/1.4.0/contrib-plugins" rel="nofollow noreferrer">grep</a> filter but it gives me some error so I try to implement below with grok. My original post is <a href="https://stackoverflow.com/questions/24994921/filter-text-from-var-log-messages-and-forward-in-logstash">here</a> . I found <a href="https://stackoverflow.com/questions/18208412/filtering-specific-lines">this</a> but m quite unsatisfied. </p>
  
  <p>Following is the configuration for logstash-forwarder file-name: logstash-forwarder in client-server</p>
  
  <pre><code>{
    "network": {
      "servers": [ "logstashserver-ip:5000" ],
      "timeout": 15,
      "ssl ca": "xxx.crt"
    },
    "files": [
      {
        "paths": [
          "/var/log/messages"
         ],
        "fields": { "type": "syslog" }
      }
     ]
  }
  </code></pre>
  
  <p>and following is the logstash configuration in logstashserver</p>
  
  <p>file-name:input.conf</p>
  
  <pre><code>input {
    lumberjack {
      port =&gt; 5000
      type =&gt; "logs"
      ssl_certificate =&gt; "xxx.crt"
      ssl_key =&gt; "xxx.key"
    }
  }
  </code></pre>
  
  <p>file-name:filter.conf</p>
  
  <pre><code>filter {
      grok {
          match =&gt; ["message", "\[%{WORD:messagetype}\]: %{GREEDYDATA}"]
      }
  }
  </code></pre>
  
  <p>file-name:output.conf</p>
  
  <pre><code>output {
    elasticsearch { host =&gt; "logstashserver-ip" }
    if [messagetype] == "ERROR" {
          stdout {
              codec =&gt; "rubydebug"
          }
  }
  }
  </code></pre>
  
  <p>Is there anything wrong?</p>