GROK filter for JBOSS

Elastic Stack Logstash
1

I'm new to the ELK stack and I'm trying to setup a GROK filter with multi-line pattern but I'm not having any luck.
The pattern formatter I am needing is "%d{HH:mm:ss,SSS} %-5p [%c] {%t) %s%E%n"/
I am also needing for the timestamp in Kibana to so the time from the Log and not the time that Elasticsearch received the log. Any help is greatly appreciated.

Thanks,
Michael

2

If you post an example log message you're more likely to get help. Keep in mind that these messages can span multiple lines. There should be several examples of how to deal with that in the archives.

3

Here is an example of a log
14:33:07,069 INFO [net.jawr.web.resource.bundle.factory.BundlesHandlerFactory] (ServerService Thread Pool -- 74) Adding custom bundle definitions.

4

Does the name of the file contain the date? Otherwise you're going to have problems getting a reliable timestamp. Ignoring the timestamp issue for a while, the following grok filter probably works:

filter {
  grok {
    match => [
      "message", 
      "%{TIME:time} %{LOGLEVEL:level} \[(?<logger>[^\]]+)\] \((?<thread>[^)]+)\) %{GREEDYDATA:message}"
    ]
    overwrite => ["message"]
  }
}
1 Like
5

I have added the date into the log file and the new log looks like:
August 10 2015 10:07:01,048 INFO [org.jboss.as.naming] (ServerService Thread Pool -- 38) JBAS011800: Activating Naming Subsystem

my current grok filter is:
filter {
if [type] == "jboss" {
grok {
match => [
"message",
"%{TIME:time} %{LOGLEVEL:level}.*[(?[^]]+)] ((?[^)]+)) %{GREEDYDATA:message}"
]
overwrite => ["message"]
}
}

How can I get the date to show up with the time when looking in Kibana. The @timestamp tag in Kibana is showing the time that elasticsearch did its thing, but not the actual time of the log.

Thanks,
Michael

6

Use the date filter. Something like

date {
  match => ["time", "MMM dd YYYY HH:mm:ss,SSS"]
  remove_field => ["time"]
}

should work.

1 Like
7

Where does it fit into my current filter?

8

Add it after your current grok filter.

filter {
  grok {
    ...
  }
  date {
    ..
  }
}
1 Like