Dissect Logs

You posted in the Elasticsearch category vs Logstash so was assuming you were talking about ingest pipelines.

In Logstash you will use the Grok Filter with the same pattern I posted above.

filter {
 grok {
  match => { "message": "conn=10 op=221996 RESULT err=0 tag=101 nentries=1 wtime=0.000062880 optime=0.000082472 etime=0.000143846" }
 }
}
1 Like