Grok newbie requesting guidance

[camerodity (Mike Cameron)]

Greetings! I am using the grok filter in Logstash to parse some metrics output that were normally sent to Ganglia, and we want to now use in Kibana for various Dashboard/Visualizations. A typical log file entry is along the lines of:

type=[TIMER|METER|GAUGE], name=<metric_name>, count=, additional_fields=, (where additional fields could be count= , max= , min= , median= ,etc..)

I am working on a grok pattern to put the additional_fields in their own logstash fields if they are present in the log output, but if they aren't (for example the TIMER type may not have the mean_rate field whereas the METER type does).

Is there a way to have one grok pattern to accomplish this?

[Badger]

A kv filter might be a better approach.

[camerodity (Mike Cameron)]

Thanks! With a slight bit of tweaking with the KV filter I am now able to have the metric fields show up in Kibana correctly! I really appreciate your response.