Grok pattern creation

Elastic Stack Logstash
1

2018-05-25 10:53:15.8779 fucntionality:nil request:enter user_id:3623 school_id:4 result:success username:(('Reka',),)
2018-05-25 10:53:15.8888 functionality:nil request:enter user_id:3648 school_id:8 result:success username:(('AMRUTh',),)
2018-05-25 10:53:16.8388 functionality:nil request:enter user_id:6000 school_id:9 result:success username:(('Sahu',),)

can anyone please create grok pattern for the above logs

2

I suggest you use a grok or a dissect filter to extract two fields from each log message:

  • One field with the timestamp.
  • One field with the rest of the string (containing the key:value pairs at the end).

Then use a a kv filter to parse the field with the key:value pairs.

3

Here are some good links used for creating groks that I have found useful/bookmark:
http://grokconstructor.appspot.com/do/constructionstep
http://grokdebug.herokuapp.com/
https://docs.microsoft.com/en-us/dotnet/standard/base-types/regular-expression-language-quick-reference#quantifiers