Can you grok a grok/aggregated result?

Hi Everyone,

I'm working on a categorization of results based on what is in the logs. I thought that if I aggregated the categories from the file and matched on those I could achieve the desired result. Could someone point me in the right direction please? I've been reading the documentations forever but I find that I might resort to using ruby code and implementing it with grok but again not sure how to approach that.

Example log info:

2017/20/01 [Type1] Information is here
2017/21/01 [Type2] Information is here too
2017/21/01 [Type3] Information isn't here.

Please note that I will not be aware of types right until I parse them in but Id like my data to be grouped into separate types and contain dates and messages inside. Does anyone have any ideas about how I could approach this? Also some of the logs will be multi line like this:

2017/22/01 [Type1] Information recieved:
Information string 1: String
Information string 2: Hello
Information string 3: Out of ideas
2017/23/01[Type6] Another string

So I can see that multiline in this situation would be best.

Anyone with any insights please get back to me it will be truly appreciated.

Kind regards,

Figured out the solution here for those that might need this type of thing in the future. I pushed all the results to grok with multiline. I then used aggregate on the type_id to aggregate a map with hashes of all the information. This solved it for me.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.