Grok pattern for [2017-08-19T12:47:43,822][INFO]


(Arun Prakash) #1

Hi All,

Can any one explain the grok pattern for the below lines,
[2017-08-19T12:47:43,822][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}
[2017-08-19T12:49:47,213][WARN][logstash.agent] stopping pipeline {:id=>"main"}


(Mark Walkom) #2

What have you tried so far?


(Magnus B├Ąck) #3

If you want to parse the Logstash log with Logstash you should use the --log.format option to have it produce JSON-formatted files.


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.