Grokfilter Parser error

Elastic Stack Logstash
1

I have a log file with data like this
indent preformatted text by 4 spaces
172.16.3.254 Jun 22 11:00:40 date=2020-06-22 local7 notice time=11:00:39 devname="MIBLR_FW_1" devid="FG200ETK19907000" logid="0000000013" type="traffic" subtype="forward" level="notice" vd="root" eventtime=1592803839 srcip=10.212.134.155
i made a conf program to import data to elk
but it is not parsing grok filter
My filter section is : Preformatted textfilter {

grok {
match => { "message" => "%{IP:client}%{TIMESTAMP_ISO8601:date}\s+%{GREEDYDATA:KV}"}
}

kv {
source => "KV"
field_split => " "

}
}
Am i correct..if not kindly help me to correct my program

2

my error is..
indent preformatted text by 4 spaces
[0] "_grokparsefailure"

4

Your time stamp is not in ISO8601 format which means the grok does not work.

5

well thank you but Is there another way to match this type of date format in grok..so far i found out MMM dd HH:mm:ss this for parsing but no idea how to write this in program

6

I would use dissect to extract the IP and timestamp, then a kv filter to parse the rest of the line. See this example.

1 Like
8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.