Grok Filter Parsing Logs

I have the unstructured logs receiving using the tcp input in Logstash:

"win_cpu,host=Test-Machine-01,instance=UCMS,objectname=Process Percent_User_Time=0,Percent_Privileged_Time=0 1544716850000000000\n",

I would want to use Grok Filter and parse the above data which is coming in the message field and send it to ES as below:

hostname: Test-Machine-01,
process_name: UCMS,

Is it really achievable using Grok Filter ? Please let me know. Thanks !

For sure it’s possible!
You can use this tool to help you create the pattern:

Your output almost looks like an InfluxDB line protocol from Telegraf. You should look into metrics beat to gather the same type of information.

@AquaX - Yes, output is from Telegraf, I have used metricbeats windows module to collect perfmon data, but I noticed it returns some unreal values for couple of counters, which I couldn't able to figure it out is something wrong with the beats or from the server end, so was just trying with telegraf to cross-check.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.