Logstash discards log data that does not match the file name exactly

logstash Discard log data that does not exactly match the file name

A scene , If it is determined that this file needs to be accurately collected f:\x\data\2022-05-27-231259\my.txt The data in it , Not in this way data\yyyy-mm-dd-hhmmss\my.txt file , Never collect log data .

filter {
	
	grok {
		match => {
			"[log][file][path]" => "/data/%{YEAR}-%{MONTHNUM}-%{MONTHDAY}-%{HOUR}%{MINUTE}%{SECOND}/my.txt"
		}
		tag_on_failure =>  [ "tag_failure" ]
	}
	
	if "tag_failure" in [tags]{
		drop{
			# discarded 
		}
	}
}

First of all, we need to follow log.file.path The full path of the file matches , Matching failure , Add one more tag_failure label , stay if If this is detected in logical judgment tag label , Just drop, This drop Will be discarded to the collected log line .