Grok filter 2 different logs

Elastic Stack Logstash
1

Hi,
I am trying to use the following grok filter to extract fields from log file, The log file contains 2 different style of logs, hence I wrote 2 different queries to tackle the 2 logs. However, it's failing on one of the logs..the one inside the if statement..i get "grokparsefailure error" Please help me.

filter {
grok {
match => [ "message", "%{NOTSPACE}%{TIME}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{NOTSPACE}%{NOTSPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{NOTSPACE}%{NOTSPACE}%{NOTSPACE}%{NOTSPACE} %{WORD}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{WORD}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE} %{NOTSPACE:requestType} %{NOTSPACE} %{NOTSPACE:requestStatus} %{NOTSPACE} %{NOTSPACE:requestDetails}" ]

}
if[requestType] == "PROCESSING" {
	grok {
	match => [ "message", "%{NOTSPACE}%{TIME}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{NOTSPACE}%{NOTSPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{NOTSPACE}%{NOTSPACE}%{NOTSPACE}%{NOTSPACE}%{WORD}%{NOTSPACE} %{NOTSPACE} %{NOTSPACE:requestType} %{NOTSPACE} %{NOTSPACE:requestStatus} %{NOTSPACE}%{SPACE}%{GREEDYDATA:requestDetails}" ]
	}		
}
mutate {
    remove => [ "message" ]
}

}

The log file contents below
2016-05-20 07:13:13 | INFO | [jmsContainer-10] | AQ-REQ | PROCESSING | FAILED FOR urn:gsma:imei:35774606-004713-0 I/O error on POST request for "https://spp.msg.t-mobile.com:8083/pushnotification/v1.0/message":Read timed out; nested exception is java.net.SocketTimeoutException: Read timed out
2016-05-20 13:13:50 | INFO | [[ACTIVE] ExecuteThread: '5' for queue: 'weblogic.kernel.Default (self-tuning)'] | WAKEUP-REQ | RECEIVED | urn:gsma:imei:35774606-004713-0

2

Can anybody please help me?

I am basically trying to apply grok filter to 2 different types of log structures as shown below
2016-06-03 08:45:02 | INFO | [jmsContainer-15] | AQ-REQ | PROCESSING | SUCCESS FOR urn:uuid:64543F49-6A27-4AD9-AC0D-0B0A0AA27936

2016-05-20 04:06:12 | INFO | [[ACTIVE] ExecuteThread: '8' for queue: 'weblogic.kernel.Default (self-tuning)'] | WAKEUP-REQ | SUCCESS | urn:gsma:imei:35774606-004713-0 - 200 - - {"statusCode":"success","statusMessage":"Wakeup request recieved"}

what I have is this:

filter {
grok {
match => [ "message", "%{NOTSPACE} %{NOTSPACE:threadType} %{NOTSPACE} %{NOTSPACE:requestType} %{NOTSPACE} %{NOTSPACE:requestStatus} %{NOTSPACE} %{GREEDYDATA:requestDetails}" ]

}
if[threadType] == "[[ACTIVE]" {
	grok {
	match => [ "message", "%{NOTSPACE} %{NOTSPACE:threadType} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE:requestType} %{NOTSPACE} %{NOTSPACE:requestStatus} %{NOTSPACE} %{GREEDYDATA:requestDetails}" ]
	}		
}
mutate {
    remove => [ "message" ]
}

}

I get the following when I run logstash..the fields are giving me similar output...

linux-stamp.PNG1604×364 12.8 KB

3

help. still stuck

4

Those grok expressions are unreadable. Why don't you use the csv filter instead?

5

How do you use csv filter?

6

Have you looked at the documentation or googled for examples?