hitman
(kaushik)
June 12, 2018, 6:52am
1
2018-05-25 10:53:15.8779 fucntionality:nil request:enter user_id:3623 school_id:4 result:success username:(('Reka',),)
2018-05-25 10:53:15.8888 functionality:nil request:enter user_id:3648 school_id:8 result:success username:(('AMRUTh',),)
2018-05-25 10:53:16.8388 functionality:nil request:enter user_id:6000 school_id:9 result:success username:(('Sahu',),)
can anyone please create grok pattern for the above logs
I suggest you use a grok or a dissect filter to extract two fields from each log message:
One field with the timestamp.
One field with the rest of the string (containing the key:value pairs at the end).
Then use a a kv filter to parse the field with the key:value pairs.
1 Like
CDR
(Colton)
June 12, 2018, 8:03pm
3
system
(system)
Closed
July 10, 2018, 8:03pm
4
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.