[filebeat 8.5.3] extracting log_level from message with dissect processor, ignoring right padding modifier

Elastic Stack Beats
1

I am trying to run filebeats on log files for a web application, and the messages have padding after the log level.

I:DEBUG  [http-nio-8443-exec-45] RequestCasTicketValidator 20 Dec 2022 11:00:17.221: Loading custom parameters from configuration.
I:INFO   [http-nio-8443-exec-45] AppCasAuthenticationProvider 20 Dec 2022 11:00:17.227: Assertion: org.jasig.cas.client.validation.AssertionImpl@6ea8611

I am trying to use a right-padding modifier the log level is getting parsed with the spaces included. Here's a gist showing my filebeat.yml and what I am seeing:

I tried both 8.3.3 and 8.5.3 and saw the same result.

Any ideas?

2

I think I figured it out. Some of the log entries in this file have an IP address after* the log level and I adjusted my tokenizer to toss it I:%{log_level->} %{}[%{thread}] %{class} %{log_time}:

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.