Custom logging format


(deepak kumar sahoo) #1

lets say i have a custom logging format like below:-
format is:-
year timestamp thread log_level class_name method_name message

2015-09-24 12:06:37.051 [catalina-exec-10] DEBUG ActClientServerDAO - [retSubsKeyInfo(String), [ Server Id -> 12345]]...
2015-09-24 12:06:37.051 [catalina-exec-10] DEBUG SubsKeyDAO - [select(String), [ENTRY : SubscriptionKey -> dfsdfsdfrwrxdsf]]...
2015-09-24 12:06:37.051 [catalina-exec-10] DEBUG DBHandler - [getConn(pDBID)::, [PTTID::, 12345]]...
2015-09-24 12:06:37.051 [catalina-exec-5] DEBUG DBConHandler - [getConnection(String), [Entered Get Connection for , 12345]]...
2015-09-24 12:06:37.051 [catalina-exec-5] DEBUG DBConHandler - [getConnection(String), [Leaving Get Connection for , 12345]]...

How can i create custom grok filter based on my sample logs.


(Magnus B├Ąck) #2

If you're not fluent with grok expressions (i.e. regular expressions with some extra fluff) I highly recommend using http://grokconstructor.appspot.com to build your expressions step by step. You'll want to start with something like this:

filter {
  grok {
    match => [
      "message",
      "^%{TIMESTAMP_ISO8601:timestamp} ..."
    ]
  }
}

(system) #3