title: Getting Started With Logstash Filters
body: <p>Looking for a little help getting started... I have Logstash installed (as well as ElasticSearch) but I'm struggling with my first filter.</p>
  
  <p>As a test I have it configured to read from a trimmed log file that contains 6 lines, each line begins with a time stamp such as <strong>[11/5/13 4:09:21:327 PST]</strong> followed by a bunch of other data. </p>
  
  <p>For now I have my conf file set to read this file and I'm trying to do a very basic grok filter to match the lines, maybe to grab the timestamp and then the rest of the data (from where I can start splitting it up).</p>
  
  <p>Here is what I have:</p>
  
  <pre><code>input {
    file {
      type =&gt; "chris"
      path =&gt; "/home/chris/Documents/test.log" 
    }
  }
  filter {
    grok {
      type =&gt; "chris"
      pattern =&gt; "%{GREEDYDATA:logline}"
    }
  }
  output {
    stdout {debug =&gt; true debug_format =&gt; "json"}
  }
  </code></pre>
  
  <p>I was kind of expecting (hoping) that when I ran Logstash it'd match each line and output it, then I could start breaking the lines down and filtering my adjusting the pattern but as I can't get this first basic bit to work I'm a little stumped.</p>
  
  <p>Does anyone have a similar conf file they'd be okay to share? Most of the examples I can find are more advanced and I seem to be stuck trying to get out of the gate.</p>
  
  <p>Thanks,</p>
  
  <p>Chris.</p>