Create filter

[nejmeddine_ammar]

i 'am new in ELK , can you help me to create grok for the data

[weltenwort (Felix Stürmer)]

Hi @nejmeddine_ammar,

are you intending to execute the grok pattern in logstash or in an ingest node pipeline?

[nejmeddine_ammar]

@weltenwort

dans logstash

hi weltenword ,
i 'am intending to execute the grok pattern in logstash

[weltenwort (Felix Stürmer)]

I don't speak French enough to derive useful field names, but maybe this can give you a starting point:

%{DATESTAMP:@timestamp} \|\| : %{DATA:service} *[,:] *%{DATA:event} *: %{GREEDYDATA:message}

It should result in something like

{
  "@timestamp": "08/02/2019 07:02:12",
  "service": "Service Commande",
  "event": "CancelCommandeVenteBilling",
  "message": "Erreur annulation commande de vente dans NaviBilling.Le produit commande de vente n° 1544531 est introuvable dans NaviBilling"
}