I would like to use logstash to format my logs. Specifically, I have a log with the following format format: timestamp [thread-name] log-level class-name - log-message example: 2021-03-30 09:38:20.201 [ConnectionChecker] ERROR c.b.a.websocket.WebSocketOnlineUser - SendPing failed. roomHash:null…

[image] its-ogawa: One is that the delimiter of the format is a tab, and logstash does not recognize tabs well. This is no problem for dissect, you just need to use a literal tab in your mapping pattern. Using your example, if you have a message like this one, where the fields are delimited …

Discuss the Elastic Stack

Csv filter plugin not working

Elastic Stack Logstash

Badger March 31, 2021, 2:36am 6

Many things. I suggest you read this, which talks about grok, but the same applies to dissect. Build the pattern one field at a time.

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.