I am trying to parse my log files. It was working however there is a new requirement and I need new field from the parsed logs.
Logs are more or less:
|2018-02-01 13:48:00.882|[v22.214.171.124]|DEBUG|[EndpointFirst] |Session activated (documentId: 508, workflow id: 1)|
|2018-02-01 13:48:00.901|[v126.96.36.199]|INFO|[Custom.EndpointSecond [Document 508]]|Firing event 'DocumentReceived' on state machine with current state 'Initial' and event argument 'CustomArgument'.|
My grok filter:
Now I got the following fields (result from test grok patterns):
after match: Firing event 'DocumentReceived' on state machine with current state 'Initial' and event argument 'CustomArgument'.
What I want to achieve?
- I would like to have new field <my_document> which should be parsed from [Custom.EndpointSecond·[Document·508]] (if there is no log with [Document x] then this field should be empty.
- I would like to have message populated with the string which starts after <my_endpoint> field.
Any help will be appreciated