Grok Filter Parsing Logs

Elastic Stack Logstash
1

Hi-
I have the unstructured logs receiving using the tcp input in Logstash:

"win_cpu,host=Test-Machine-01,instance=UCMS,objectname=Process Percent_User_Time=0,Percent_Privileged_Time=0 1544716850000000000\n",

I would want to use Grok Filter and parse the above data which is coming in the message field and send it to ES as below:

{
hostname: Test-Machine-01,
process_name: UCMS,
Percent_User_Time=0,
Percent_Privileged_Time=0
}

Is it really achievable using Grok Filter ? Please let me know. Thanks !

2

For sure it’s possible!
You can use this tool to help you create the pattern:
https://grokdebug.herokuapp.com/

Your output almost looks like an InfluxDB line protocol from Telegraf. You should look into metrics beat to gather the same type of information.

3

@AquaX - Yes, output is from Telegraf, I have used metricbeats windows module to collect perfmon data, but I noticed it returns some unreal values for couple of counters, which I couldn't able to figure it out is something wrong with the beats or from the server end, so was just trying with telegraf to cross-check.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.