logstash / cookbook

Community-driven cookbook of extra logstash documentation, tricks, etc.

Logstash

Logstash is part of the Elastic Stack along with Beats, Elasticsearch and Kibana. Logstash is a server-side data processing pipeline that ingests data from a multitude of sources simultaneously, transforms it, and then sends it to your favorite "stash." (Ours is Elasticsearch, naturally.). Logstash has over 200 plugins, and you can write your own very easily as well.

For more info, see https://www.elastic.co/products/logstash

Documentation and Getting Started

You can find the documentation and getting started guides for Logstash on the elastic.co site

For information about building the documentation, see the README in https://github.com/elastic/docs

Downloads

You can download officially released Logstash binaries, as well as debian/rpm packages for the supported platforms, from downloads page.

Need Help?

• Logstash Forum
• Logstash Documentation
• #logstash on freenode IRC
• Logstash Product Information
• Elastic Support

Logstash Plugins

Logstash plugins are hosted in separate repositories under the logstash-plugins github organization. Each plugin is a self-contained Ruby gem which gets published to RubyGems.org.

Writing your own Plugin

Logstash is known for its extensibility. There are hundreds of plugins for Logstash and you can write your own very easily! For more info on developing and testing these plugins, please see the working with plugins section

Plugin Issues and Pull Requests

Please open new issues and pull requests for plugins under its own repository

For example, if you have to report an issue/enhancement for the Elasticsearch output, please do so here.

Logstash core will continue to exist under this repository and all related issues and pull requests can be submitted here.

Developing Logstash Core

Prerequisites

• Install JDK version 11 or 17. Make sure to set the JAVA_HOME environment variable to the path to your JDK installation directory. For example set JAVA_HOME=<JDK_PATH>
• Install JRuby 9.2.x It is recommended to use a Ruby version manager such as RVM or rbenv.
• Install rake and bundler tool using gem install rake and gem install bundler respectively.

RVM install (optional)

If you prefer to use rvm (ruby version manager) to manage Ruby versions on your machine, follow these directions. In the Logstash folder:

gpg --keyserver hkp://keys.gnupg.net --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3
\curl -sSL https://get.rvm.io | bash -s stable --ruby=$(cat .ruby-version)

Check Ruby version

Before you proceed, please check your ruby version by:

$ ruby -v

The printed version should be the same as in the .ruby-version file.

Building Logstash

The Logstash project includes the source code for all of Logstash, including the Elastic-Licensed X-Pack features and functions; to run Logstash from source using only the OSS-licensed code, export the OSS environment variable with a value of true:

export OSS=true

• Set up the location of the source code to build

export LOGSTASH_SOURCE=1
export LOGSTASH_PATH=/YOUR/LOGSTASH/DIRECTORY

Install dependencies with gradle (recommended)¹

• Install development dependencies

./gradlew installDevelopmentGems

• Install default plugins and other dependencies

./gradlew installDefaultGems

Verify the installation

To verify your environment, run the following to start Logstash and send your first event:

bin/logstash -e 'input { stdin { } } output { stdout {} }'

This should start Logstash with stdin input waiting for you to enter an event

hello world
2016-11-11T01:22:14.405+0000 0.0.0.0 hello world

Advanced: Drip Launcher

Drip is a tool that solves the slow JVM startup problem while developing Logstash. The drip script is intended to be a drop-in replacement for the java command. We recommend using drip during development, in particular for running tests. Using drip, the first invocation of a command will not be faster but the subsequent commands will be swift.

To tell logstash to use drip, set the environment variable JAVACMD=`which drip`.

Example (but see the Testing section below before running rspec for the first time):

JAVACMD=`which drip` bin/rspec

Caveats

Drip does not work with STDIN. You cannot use drip for running configs which use the stdin plugin.

Building Logstash Documentation

To build the Logstash Reference (open source content only) on your local machine, clone the following repos:

logstash - contains main docs about core features

logstash-docs - contains generated plugin docs

docs - contains doc build files

Make sure you have the same branch checked out in logstash and logstash-docs. Check out master in the docs repo.

Run the doc build script from within the docs repo. For example:

./build_docs.pl --doc ../logstash/docs/index.asciidoc --chunk=1 -open

Testing

Most of the unit tests in Logstash are written using rspec for the Ruby parts. For the Java parts, we use junit. For testing you can use the test rake tasks and the bin/rspec command, see instructions below:

Core tests

1- To run the core tests you can use the Gradle task:

./gradlew test

or use the rspec tool to run all tests or run a specific test:

bin/rspec
bin/rspec spec/foo/bar_spec.rb

Note that before running the rspec command for the first time you need to set up the RSpec test dependencies by running:

./gradlew bootstrap

2- To run the subset of tests covering the Java codebase only run:

./gradlew javaTests

3- To execute the complete test-suite including the integration tests run:

./gradlew check

4- To execute a single Ruby test run:

SPEC_OPTS="-fd -P logstash-core/spec/logstash/api/commands/default_metadata_spec.rb" ./gradlew :logstash-core:rubyTests --tests org.logstash.RSpecTests

5- To execute single spec for integration test, run:

./gradlew integrationTests -PrubyIntegrationSpecs=specs/slowlog_spec.rb

Sometimes you might find a change to a piece of Logstash code causes a test to hang. These can be hard to debug.

If you set LS_JAVA_OPTS="-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5005" you can connect to a running Logstash with your IDEs debugger which can be a great way of finding the issue.

Plugins tests

To run the tests of all currently installed plugins:

rake test:plugins

You can install the default set of plugins included in the logstash package:

rake test:install-default

---

Note that if a plugin is installed using the plugin manager bin/logstash-plugin install ... do not forget to also install the plugins development dependencies using the following command after the plugin installation:

bin/logstash-plugin install --development

Building Artifacts

Built artifacts will be placed in the LS_HOME/build directory, and will create the directory if it is not already present.

You can build a Logstash snapshot package as tarball or zip file

./gradlew assembleTarDistribution
./gradlew assembleZipDistribution

OSS-only artifacts can similarly be built with their own gradle tasks:

./gradlew assembleOssTarDistribution
./gradlew assembleOssZipDistribution

You can also build .rpm and .deb, but the fpm tool is required.

rake artifact:rpm
rake artifact:deb

and:

rake artifact:rpm_oss
rake artifact:deb_oss

Using a Custom JRuby Distribution

If you want the build to use a custom JRuby you can do so by setting a path to a custom JRuby distribution's source root via the custom.jruby.path Gradle property.

E.g.

./gradlew clean test -Pcustom.jruby.path="/path/to/jruby"

Project Principles

• Community: If a newbie has a bad time, it's a bug.
• Software: Make it work, then make it right, then make it fast.
• Technology: If it doesn't do a thing today, we can make it do it tomorrow.

Contributing

All contributions are welcome: ideas, patches, documentation, bug reports, complaints, and even something you drew up on a napkin.

Programming is not a required skill. Whatever you've seen about open source and maintainers or community members saying "send patches or die" - you will not see that here.

It is more important that you are able to contribute.

For more information about contributing, see the CONTRIBUTING file.

Footnotes

Footnotes

1. Use bundle instead of gradle to install dependencies

   Alternatively, instead of using gradle you can also use bundle:

   • Install development dependencies

     bundle config set --local path vendor/bundle
     bundle install
     

   • Bootstrap the environment:

     rake bootstrap
     

   • You can then use bin/logstash to start Logstash, but there are no plugins installed. To install default plugins, you can run:

     rake plugin:install-default
     

   This will install the 80+ default plugins which makes Logstash ready to connect to multiple data sources, perform transformations and send the results to Elasticsearch and other destinations.

   ↩

cookbook's Issues

Site unavailable

The site http://cookbook.logstash.net (linked from this repo's description) is no longer resolving. It's been removed from DNS.

Windows service incorrect; no longer a jar file

http://cookbook.logstash.net/recipes/windows-service/

query failed on logstash

The query '*' resulted the following error:

org.elasticsearch.action.search.SearchPhaseExecutionException: Failed to execute phase [query], total failure; shardFailures {[yOyNYFaTYaQfkKXq7QaRw][mcare][1]: RemoteTransportException[[es-1][inet[/10.1.3.10:9300]][search/phase/query]]; nested: SearchParseException[[mcare][1]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [Failed to parse source [{"from":0,"size":50,"query":{"query_string":{"query":"","default_operator":"and"}},"sort":[{"@timestamp":{"order":"desc"}}]}]]]; nested: SearchParseException[[mcare][1]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [No mapping found for [@timestamp] in order to sort on]]; }{[03aCVBiST0in9Nvuhpd4Fw][knowledge][3]: RemoteTransportException[[es-1][inet[/10.1.3.9:9300]][search/phase/query]]; nested: SearchParseException[[knowledge][3]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [Failed to parse source [{"from":0,"size":50,"query":{"query_string":{"query":"","default_operator":"and"}},"sort":[{"@timestamp":{"order":"desc"}}]}]]]; nested: SearchParseException[[knowledge][3]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [No mapping found for [@timestamp] in order to sort on]]; }{[yOyNYFaTYaQfkKXq7QaRw][graylog2][0]: RemoteTransportException[[es-1][inet[/10.1.3.10:9300]][search/phase/query]]; nested: SearchParseException[[graylog2][0]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [Failed to parse source [{"from":0,"size":50,"query":{"query_string":{"query":"","default_operator":"and"}},"sort":[{"@timestamp":{"order":"desc"}}]}]]]; nested: SearchParseException[[graylog2][0]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [No mapping found for [@timestamp] in order to sort on]]; }{[yOyNYFaTYaQfkKXq7QaRw][mcare][0]: RemoteTransportException[[es-1][inet[/10.1.3.10:9300]][search/phase/query]]; nested: SearchParseException[[mcare][0]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [Failed to parse source [{"from":0,"size":50,"query":{"query_string":{"query":"","default_operator":"and"}},"sort":[{"@timestamp":{"order":"desc"}}]}]]]; nested: SearchParseException[[mcare][0]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [No mapping found for [@timestamp] in order to sort on]]; }{[03aCVBiST0in9Nvuhpd4Fw][knowledge][1]: RemoteTransportException[[es-1][inet[/10.1.3.9:9300]][search/phase/query]]; nested: SearchParseException[[knowledge][1]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [Failed to parse source [{"from":0,"size":50,"query":{"query_string":{"query":"","default_operator":"and"}},"sort":[{"@timestamp":{"order":"desc"}}]}]]]; nested: SearchParseException[[knowledge][1]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [No mapping found for [@timestamp] in order to sort on]]; }{[03aCVBiST0in9Nvuhpd4Fw][graylog2][3]: RemoteTransportException[[es-1][inet[/10.1.3.9:9300]][search/phase/query]]; nested: SearchParseException[[graylog2][3]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [Failed to parse source [{"from":0,"size":50,"query":{"query_string":{"query":"","default_operator":"and"}},"sort":[{"@timestamp":{"order":"desc"}}]}]]]; nested: SearchParseException[[graylog2][3]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [No mapping found for [@timestamp] in order to sort on]]; }{[yOyNYFaTYaQfkKXq7QaRw][graylog2][4]: RemoteTransportException[[es-1][inet[/10.1.3.10:9300]][search/phase/query]]; nested: SearchParseException[[graylog2][4]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [Failed to parse source [{"from":0,"size":50,"query":{"query_string":{"query":"","default_operator":"and"}},"sort":[{"@timestamp":{"order":"desc"}}]}]]]; nested: SearchParseException[[graylog2][4]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [No mapping found for [@timestamp] in order to sort on]]; }{[yOyNYFaTYaQfkKXq7QaRw][mcare][3]: RemoteTransportException[[es-1][inet[/10.1.3.10:9300]][search/phase/query]]; nested: SearchParseException[[mcare][3]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [Failed to parse source [{"from":0,"size":50,"query":{"query_string":{"query":"","default_operator":"and"}},"sort":[{"@timestamp":{"order":"desc"}}]}]]]; nested: SearchParseException[[mcare][3]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [No mapping found for [@timestamp] in order to sort on]]; }{[yOyNYFaTYaQfkKXq7QaRw][mcare][4]: RemoteTransportException[[es-1][inet[/10.1.3.10:9300]][search/phase/query]]; nested: SearchParseException[[mcare][4]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [Failed to parse source [{"from":0,"size":50,"query":{"query_string":{"query":"","default_operator":"and"}},"sort":[{"@timestamp":{"order":"desc"}}]}]]]; nested: SearchParseException[[mcare][4]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [No mapping found for [@timestamp] in order to sort on]]; }{[03aCVBiST0in9Nvuhpd4Fw][knowledge][2]: RemoteTransportException[[es-1][inet[/10.1.3.9:9300]][search/phase/query]]; nested: SearchParseException[[knowledge][2]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [Failed to parse source [{"from":0,"size":50,"query":{"query_string":{"query":"","default_operator":"and"}},"sort":[{"@timestamp":{"order":"desc"}}]}]]]; nested: SearchParseException[[knowledge][2]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [No mapping found for [@timestamp] in order to sort on]]; }{[yOyNYFaTYaQfkKXq7QaRw][graylog2][1]: RemoteTransportException[[es-1][inet[/10.1.3.10:9300]][search/phase/query]]; nested: SearchParseException[[graylog2][1]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [Failed to parse source [{"from":0,"size":50,"query":{"query_string":{"query":"","default_operator":"and"}},"sort":[{"@timestamp":{"order":"desc"}}]}]]]; nested: SearchParseException[[graylog2][1]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [No mapping found for [@timestamp] in order to sort on]]; }{[yOyNYFaTYaQfkKXq7QaRw][knowledge][0]: RemoteTransportException[[es-1][inet[/10.1.3.10:9300]][search/phase/query]]; nested: SearchParseException[[knowledge][0]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [Failed to parse source [{"from":0,"size":50,"query":{"query_string":{"query":"","default_operator":"and"}},"sort":[{"@timestamp":{"order":"desc"}}]}]]]; nested: SearchParseException[[knowledge][0]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [No mapping found for [@timestamp] in order to sort on]]; }{[03aCVBiST0in9Nvuhpd4Fw][knowledge][4]: RemoteTransportException[[es-1][inet[/10.1.3.9:9300]][search/phase/query]]; nested: SearchParseException[[knowledge][4]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [Failed to parse source [{"from":0,"size":50,"query":{"query_string":{"query":"","default_operator":"and"}},"sort":[{"@timestamp":{"order":"desc"}}]}]]]; nested: SearchParseException[[knowledge][4]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [No mapping found for [@timestamp] in order to sort on]]; }{[yOyNYFaTYaQfkKXq7QaRw][graylog2][2]: RemoteTransportException[[es-1][inet[/10.1.3.10:9300]][search/phase/query]]; nested: SearchParseException[[graylog2][2]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [Failed to parse source [{"from":0,"size":50,"query":{"query_string":{"query":"","default_operator":"and"}},"sort":[{"@timestamp":{"order":"desc"}}]}]]]; nested: SearchParseException[[graylog2][2]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [No mapping found for [@timestamp] in order to sort on]]; }{[yOyNYFaTYaQfkKXq7QaRw][mcare][2]: RemoteTransportException[[es-1][inet[/10.1.3.10:9300]][search/phase/query]]; nested: SearchParseException[[mcare][2]: query[ConstantScore(NotDeleted(:))],from[0],size[50]: Parse Failure [Failed to parse source [{"from":0,"size":50,"query":{"query_string":{"query":"","default_operator":"and"}},"sort":[{"@timestamp":{"order":"desc"}}]}]]]; nested: SearchParseException[[mcare][2]: query[ConstantScore(NotDeleted(:*))],from[0],size[50]: Parse Failure [No mapping found for [@timestamp] in order to sort on]]; }

animate background gradient change of featurelet buttons

when :hover on a featurelet button, the border fades in smoothly over 0.5s, but the background gradient snaps from A to B instantly, creating a distracting flash effect.

Convert central-syslog recipe to 1.4.x syntax rules

• Use conditionals
• Remove deprecated configuration
• Add a test

Code is not included in recipes

Instead of code being included in the page, the include_code block is visible

example in http://cookbook.logstash.net/recipes/rsyslog-agent/

configure rsyslog
The rsyslog daemon is useful for both taking local syslog messages as well as for pulling logs from files.
To watch files with rsyslog, you want to use the imfile rsyslog module.
For example, let’s say we want to forward local syslog as well as apache and mysql log files to logstash.
{% include_code rsyslog.conf %}

configure logstash
Now, logstash needs to be told to accept syslog input. This is simple enough. Here is an example config that takes syslog and emits it to stdout:
{% include_code logstash.conf %}

find out why logging-from-nodejs recipe is causing gh-pages failure

Can someone post here the error messages (if any) that are being generated so I can help research this gh-pages issue

thanks

Site still unavailble

The website is not there. Bummer.

logstash.sh script (Running with init cookbook) missing $delay parameter value

Hi,

Using logstash on a RHEL 6.4 host, In the logstash.sh script do_stop() function, there's the line:
checkpid $pid && sleep $delay &&

but $delay is not defined and we get:

sleep: missing operand
Try `sleep --help' for more information.

You can check the killproc function in /etc/init.d/functions as an example.

Is there one to index and analyse iOS Crash logs

Dir.glob in ruby-filewatcher sometimes returning [] for valid files

We noticed a problem with our logstash-client whereby it didn't seem to be tailing over 50% of the log files that we'd configured it to watch.

Eventually we tracked it down to a problem in ruby-filewatcher in the watch.rb file in '_discover_file'.

On the first line of that function is a call to 'Dir.glob' which was returning an empty array even for files which we know exist and are accessible by the logstash user.

We're running logstash 1.1.1 (which internally uses the jRuby 1.6.7 interpretor, but on trying out 'Dir.glob' on a local instance of that interpretor we couldn't replicate the problem).

We wrote a hack to help us get around it here -> alphagov/ruby-filewatch@9daaab8 - but presumably there's a cleaner solution to this.

Has anyone else experienced this problem?

Mark

change styling to fit logstash.net

hi :)
how about changing the whole theme that is matches logstash.net and integrates seamless into it?
i could give it a try if you don't actually want it to look that different and dark ^^

update upstart example to set HOME environment var

if you don't explicitely set it the embedded elasticsearch tries to create it's data dir in the logstash user's dir (which happened for me because I had created the UID with a home dir)

better to explicitly set it in the upstart config IMO

cookbook.logstash.net is down

You may already be aware of this, but cookbook.logstash.net just returns a 404 not found page.

An example of an integrated rspec test, testing all of input+filter+output?

i.e. something like https://github.com/logstash/logstash/wiki/Testing-your-filters but not isolated to filters.

Rather an integrated end-to-end test of loading a custom (output) plugin that provides a set of sample files, specifies inputs, some filters and an output parameters for that plugin.

Ideally it would include stubbing out the backend implementation of the output so that the test can ensure that the filter+output is invoking the right sequence of operations on the backend.

I realise this might be a lot to ask for - portions would still be useful, especially the basics of an integrated test.

Thanks, M.

rsyslog is leaving out a required type parameter for syslog input

When I follow the instructions here: http://cookbook.logstash.net/recipes/rsyslog-agent/

I get this error:

{"message":"Using experimental plugin 'syslog'. This plugin is untested and may change in the future. For more information about plugin statuses, see http://logstash.net/docs/1.1.1-pre/plugin-status ","level":"warn"}
{"message":"Missing required parameter 'type' for input/syslog","level":"error"}
{"message":"Config validation failed.","level":"error"}

High CPU usage 100%

The logstash agent Cpu usage :
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
27729 logstash 20 0 1643m 221m 16m S 101.1 1.4 0:36.80 java

Thank you for your support!

DNS issues with cookbook.logstash.net

There is "Server not found" error from yesterday.

Host lookup results using Google's nameservers:

dig @google-public-dns-a.google.com cookbook.logstash.net

; <<>> DiG 9.7.0-P1 <<>> @google-public-dns-a.google.com cookbook.logstash.net
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 245
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;cookbook.logstash.net.     IN  A

;; AUTHORITY SECTION:
logstash.net.       979 IN  SOA ns1.dreamhost.com. hostmaster.dreamhost.com. 2012110200 20085 1800 1814400 14400

;; Query time: 97 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sun Nov  4 15:48:46 2012
;; MSG SIZE  rcvd: 103

Sporadic "An unexpected error occurred" while starting up logstash

I am facing a, possible, issue with logstash 1.2.1. Sporadically, when starting it up, I receive the following error:

java -jar logstash-1.2.1-flatjar.jar agent -f conf/logstash.conf -- web
----------
Using milestone 2 input plugin 'file'. This plugin should be stable, but if you see strange behavior, please let us know! For more information on plugin milestones, see http://logstash.net/docs/1.2.1/plugin-milestones {:level=>:warn}
+---------------------------------------------------------+
| An unexpected error occurred. This is probably a bug.   |
| You can find help with this problem in a few places:    |
...
The error reported is: 
  pattern %{GREEDYDATA:message_id} not defined

My configuration file looks like this:

input {
       file {
        type => "my-component"
        path => [ "/path/to/my/log/directory/*.log" ]
        add_field => [ "API", "mycomponent"]
    }
      ...
}
filter {

    if [type] == "my-component" { 
        grok {  
            match => [ "message", "(%{GREEDYDATA:message_id}) %{TIMESTAMP_ISO8601:log_timestamp} %{LOGLEVEL:loglevel} %{GREEDYDATA:message_remainder}" ]
            add_field => ["raw_message", "%{@message}"]
        }
        mutate {
            replace => ["message", "%{message_remainder}" ]
        }   
        multiline {
            pattern => "^\s"
            what => "previous"
        }
    }
}

output {
    elasticsearch { embedded => true }
}

It works if I kill it and start it again.

date format in http://cookbook.logstash.net/recipes/apache-json-logs/

Hi,
timestamp format seems wrong, elasticsearch doesn't like it.
This is the recipe:
LogFormat "{ "@timestamp": "%{%Y/%m/%dT%H:%M:%S%z}t"
but shouldn't it be
LogFormat "{ "@timestamp": "%{%Y-%m-%dT%H:%M:%S%z}t" ?

I like this cookbook, but also would love a working example of a filter allowing to skip all 200 statuses. I tried but couldn't succeed in grepping the status field...

thanks