GROK Filter failing to parse loglevel, RequestUUID fields with Logstash 2.0.5 and Grok 2


(Pramod) #1

Log4net log

2018-11-07 19:55:06,848 DEBUG CXYZ [47] 0HLI4IVM5VCGV:00000013 Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker: Resource Filter: Before executing OnResourceExecuted on filter Microsoft.AspNetCore.Mvc.ConsumesAttribute.

GROK filter
^%{TIMESTAMP_ISO8601:timestamp}%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}?%{SPACE}?%{IPORHOST:tempHost}%{SPACE}[%{INT:thread}%{SPACE}]%{SPACE}%{NOTSPACE:requestUUID}[^:]*%{SPACE}%{DATA:logger}:%{SPACE}%{GREEDYDATA:tempMessage}

Above filter works on Grok Debugger tool but on our server which has Logstash 2.0.5 and Grok 2

Any help would be appreciated to resolve loglevel, RequestUUID

Expected Result
{
"timestamp": [
[
"2018-11-07 19:55:06,848"
]
],
"YEAR": [
[
"2018"
]
],
"MONTHNUM": [
[
"11"
]
],
"MONTHDAY": [
[
"07"
]
],
"HOUR": [
[
"19",
null
]
],
"MINUTE": [
[
"55",
null
]
],
"SECOND": [
[
"06,848"
]
],
"ISO8601_TIMEZONE": [
[
null
]
],
"SPACE": [
[
" ",
" ",
"",
" ",
"",
" ",
"",
" "
]
],
"loglevel": [
[
"DEBUG"
]
],
"tempHost": [
[
"CXYZ"
]
],
"HOSTNAME": [
[
"CXYZ"
]
],
"IP": [
[
null
]
],
"IPV6": [
[
null
]
],
"IPV4": [
[
null
]
],
"thread": [
[
"47"
]
],
"requestUUID": [
[
"0HLI4IVM5VCGV:00000013"
]
],
"logger": [
[
""
]
],
"tempMessage": [
[
"Resource Filter: Before executing OnResourceExecuted on filter Microsoft.AspNetCore.Mvc.ConsumesAttribute."
]
]
}


(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.