Grok filter logstash config

Can somebody help me out here?
So i am trying to use grok filter on a particular log file and I am having some trouble.

I used to make a pattern, but I am having trouble with it

so I have the following log entry
10:47:57,434 INFO [ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)' access:14 - |rio|provisionWSG|

I am having trouble extracting details from the following:

I am not able to separate the entire string and turn them into fields

I tried

please help!

What grok expression do you have so far?

1 Like

For this line: |rio|provisionWSG|

I have:

I have this for the entire line:
10:47:57,434 INFO [ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)' access:14 - |rio|provisionWSG|


As I believe I said in another thread, you need to match the "|" characters. For your first example something like


would work.

1 Like

Thank you so much!
This is what exactly I needed!

Writing the queries in the grok filter will be bit of hassle if we have more complicated logs. Is there any alternatives I can use so that the fields are extracted from the logs without manually writing a query in logstash file with grok filter?

Please let me know! Thanks.

Logstash doesn't contain any magic feature that parses your logs. You will, somehow, have to describe how they should be interpreted. Sometimes a grok filter is the best tool, other times a kv or csv filter is better, and sometimes you need a combination of these filters.