Grok pattern for [2017-08-19T12:47:43,822][INFO]

Elastic Stack Logstash
1

Hi All,

Can any one explain the grok pattern for the below lines,
[2017-08-19T12:47:43,822][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}
[2017-08-19T12:49:47,213][WARN][logstash.agent] stopping pipeline {:id=>"main"}

2

What have you tried so far?

3

If you want to parse the Logstash log with Logstash you should use the --log.format option to have it produce JSON-formatted files.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.