Hi I have the following log file sample:
#Fields: s-dns date time x-duration c-ip c-port c-vx-zone
ac1.lg9ams1d1.cdn 2019-01-14 05:00:01 0.001 172.30.116.146 46684 cdn
ac1.lg9ams1d1.cdn 2019-01-14 05:00:01 0.001 172.30.116.146 59064 cdn
and at the moment I am doing static parsing with grok csv based on tab separator.
The log file struture changes depending on the software version running on the server and this struture is given by the line #fields coming in beginning of each log file (see the sample above).
My idea is to grab the line fields of each log file and do the mapping accordingly but I am not sure how to do it with grok. Anyone can help?
Thanks in advance.
Ps: I am not a very experienced ELK person