Grok syslog-ng stats

Elastic Stack Logstash
4

Yes, something like this...

  mutate { split => { "stats" => "," } }
  ruby {
    code => '
      stats = Array.new
      event.get("stats").each { |x|
        x = x.strip
        x = x.split(/[=\'\)\(]+/)
        h = { "statistic_type" => x[0], "object_type" => x[1], "object_name" => x[2], "total_messages" => x[3] }
        stats.push(h)
      }
      event.set("statistics", stats)
    '
  }
#  mutate { remove_field => [ "stats" ] }