Filter Logstash syslog

Elastic Stack Logstash
1

I have the following message that is displayed in the kibana brought by filebeat from a linux syslog:

image
image.png1365×580 12.2 KB

However, I need each field of the message to be shown in the kibana as an independent field to be able to perform metrics, for example the user field:

image
image.png1355×91 4.11 KB

The configuration of my filter in logstash is the following:

image

2

SYSLOGLINE names the parsed message field "message". That field name is the source message, so you end up with an array. This should get you started:

filter {
  grok {
    match => { "message" => "%{SYSLOGLINE}" }
  }
  if [message][1] { kv { source => "[message][1]" } }
}
3

With overwrite => ["message"] in the grok filter the message field won't become an array.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.