Grok Custom filter

[zolthar-z (Luis Zabala)]

Hi

I'm new in ELK and I've installed the app for log management. I have a legacy application and want to make some tranformation to the logs, right now a I recevied the logs in the following format:

2018-10-08 13:06:28,710 DEBUG [Job] SID=[078] ServiceRunning: new service created

The idea is have the output with the next format

Datestamps: 2018-10-08 13:06:28,710
level: DEBUG
SID: 078
Message: ServiceRunning: new service created

I have tried with differents filters like "%{DATESTAMP} %{LOGLEVEL:level} %{WORD:SID}" but the output doesn't show as I expected, So I was wondering if maybe one of you know if is possible create that output with logstash filters

Thanks in advance for your help.

Regards.

[Tek_Chand]

@Luis, Please try the below pattern for your log:

(?<datestamp>[\w\-\s\:]+)\,(?<pid>[\w]+)\s(?<loglevel>[\w]+)\s\[\w+\]\s\w+\=\[(?<SID>[\w]+)\]\s(?<message>.*)

Thanks

[zolthar-z (Luis Zabala)]

@Tek_Chand

(?<datestamp>[\w-\s:]+),(?<pid>[\w]+)\s(?<loglevel>[\w]+)\s[\w+]\s\w+=[(?<SID>[\w]+)]\s(?<message>.*)

Hi @Tek_Chand, thanks for the information, it works perfectly!!!, Do you know where I can find the meaning or how I can do all the filters that you apply ? Thanks again.

[Tek_Chand]

Hello Luis,

You should have some idea of regex to write the filter. Please refer the below link for some basic regex symbol:

https://en.wikipedia.org/wiki/Regular_expression

You can use grok debugger to write filter for your logs pattern. Please refer the below link:

https://grokdebug.herokuapp.com/

Thanks.