Field Parse Issue

Elastic Stack Logstash
1

I have CSV field & logstash ins't parsing it entirely, i have the first few fields parsed correctly yet once it comes across console it seems to stop parsing. Any idea of fixes?

Here is my code


filter {
    csv {
        columns => [ "rcd", "ASID", "TIMESTAMP", "SMFID", "JOBNUM", "CONSOLE", "ROUTECODE", "DESCRIPTOR", "JOBNAME", "FLAGS", "TEXT" ]
        separator => ","
    }
    mutate { add_field => { "[@metadata][timestamp]" => "%{TIMESTAMP}" }}
    date { match => ["[@metadata][timestamp]", "yyD HH.mm.ss.SSS Z"] } 
}
2

My data had spaces. I guess it doesn't like spaces in this new update?

3

What does your [message] field look like?

4

My customData.log file
{"Time": "2022-05-12T04:18:46.077", "HostName": "ABCDEFG", "Cat": "JOBLOG", "Severity": "Err", "SAF": 1, "SAFD": "RACF", "Name": "TEST", "JobName": "DBS1MSTR", "JobID": "JOB12345", "Rec": " 23:18:36 ERROR ID=DSNLIRTR000300000000000::172.31.206.121 FOR THREAD WITH"}

5

That's not CSV it is JSON. Try a json filter.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.