Creating new field with logstash

Elastic Stack Logstash
1

I have a file named "Job Code.txt"

job_id=0001,description=Ship data from server to elknode1,result=OK
job_id=0002,description=Ship data from server to elknode2,result=Error: Msg...
job_id=0003,description=Ship data from server to elknode3,result=OK
job_id=0004,description=Ship data from server to elknode4,result=OK

Here is the filter part of my .conf file but it doesn't work. How can I created new field, i.e. jobID, description, result as to be seen in kibana

filter{
grok{ match => {"message" => ["JobID: %{NOTSPACE:job_id}","description: %{NOTSPACE:description}","result: %{NOTSPACE:message}"]}
add_field => {
"JobID" => "%{job_id}"
"Description" => "%{description}"
"Message" => "%{message}"
}
}
if [job_id] == "0001" {
aggregate {
task_id => "%{job_id}"
code => "map['time_elasped']=0"
map_action => "create"
}
}
if [job_id] == "0003" {
aggregate {
task_id => "%{job_id}"
code => "map['time_elasped']=0"
map_action => "update"
}
}
if [job_id] == "0002" {
aggregate {
task_id => "%{job_id}"
code => "map['time_elasped']=0"
map_action => "update"
}
}

2

I invite you to fix your grok configuration :

grok{
  match => {"message" => ["job_id=%{NOTSPACE:job_id},description=%{DATA:description},result= 
%{GREEDYDATA:result}"]
}

If in Kibana, you aim to have a field named JobID, you can directly name your field JobID in grok expression :

grok{
  match => {"message" => ["job_id=%{NOTSPACE:JobID},description=%{DATA:description},result= 
%{GREEDYDATA:result}"]
}
3

Given your log line format, I advice you to use "kv" filter rather than "grok" :

kv {
  field_split => ","
}