Hi @ all,
i struggle with above mentioned unstructured pattern and would like to extract parts into
5 new fields while indexing using logstash grok : ResourceA1=here ResourceA2=heretoo ResourceA3=hereagain ResourceA4=herewego Text=alliswellstructured-:o)
Due to its specific start and length
I'm unable to solve the right pattern.
Hope you can help.
You can use KV filter, as your log is already in Key Value format.
filter{
kv{
source => "message"
}
}
Edit : You can use mutate filter to remove the fields that you don't want to index, because kv filter will add all the keys present in the log as fields.
] has a special meaning in a regexp (it closes a character group) so it needs to be escaped using \. That is not the case for }, which does not need to be escaped.
Oh man then I were right but tought I were wrong because the Closed Square Bracket behind Type2 associated to the opening and the obvious to close were not obvious though...
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.