title: grok pattern to get lines with particular word from logfiles in Logstash
body: <p>I am trying to implement Logstash for logging few custom files, for which I have to get the lines containing the words : " out of swap memory". Following are the content of /etc/logstash/conf.d/10-syslog.conf file where in I have created custom_error type filter for the custom log files which I need to log to get the desired line :</p>
  
  <pre><code> filter {
    if [type] == "syslog" {
      grok {
        match =&gt; { "message" =&gt; "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
        add_field =&gt; [ "received_at", "%{@timestamp}" ]
        add_field =&gt; [ "received_from", "%{host}" ]
      }
      syslog_pri { }
      date {
        match =&gt; [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
      }
    }
    if [type] == "custom_error" {
      grok {
        match =&gt; { "message" =&gt; "Exception java.lang.OutOfMemoryError: requested %{NUMBER:int} bytes for promotion. Out of swap space?" }
        add_field =&gt; [ "received_at", "%{@timestamp}" ]
        add_field =&gt; [ "received_from", "%{host}" ]
      }
    date {
      match =&gt; [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
    }
   }
  }
  </code></pre>
  
  <p>But still I am not getting the desired result and lot of other messages along with required line are also showing up which is making the log message far too lengthy. 
  How shall I  achieve just the required line from log files?</p>