Grokparsefailure on logstash

Elastic Stack Logstash
1

Hi ES users, i'm trying to send a simple log using filebeat on to ES via logstash and i'm experiencing grokparsefailure errors on kibana. Can someone please assist on what type of grok filter needs to be used? Below is the file i'm trying to input via filebeat.
CreateTime:1621009744368 PING
CreateTime:1621009748711 PING
CreateTime:1621009753392 PING
CreateTime:1621009757660 PING
CreateTime:1621009761982 PING
CreateTime:1621009766368 PING
CreateTime:1621009770798 PING
CreateTime:1621009775271 PING

Thanks,
SRK

2

What does your grok filter configuration look like?

3

Hi Badger,
Following is the grok filter for existing file and the one i shared earlier is the new file without any grok.

filter{
grok {
match => { "message" => "[%{TIMESTAMP_ISO8601:log-timestamp}] %{LOGLEVEL:log-level} %{GREEDYDATA:log-message}" }
}
mutate {
remove_field => [ "message" ]
}
}
Thanks,
SRK

4

That pattern in no way matches the example log entry you gave. It has a timestamp in milliseconds since the epoch, not an ISO8601 timestamp, it does not have square brackets, it does not have a LOGLEVEL. It is just completely the wrong pattern.

5

Yes, that's what i am trying to show. That pattern is for existing log input file but i just added the new log output that i shared earlier and i want to know what grok pattern fits for the new log entry.

Thanks,
SRK.

6

Hi Badger,
I am trying to get the correct grok filter for the below line:
CreateTime:1621314039222 PING

grok {
match => { "message" => "%{GREEDYDATA:time}:%{NUMBER:timestamp} %{SPACE} %{GREEDYDATA:message}"
}

Can you please correct it?

Thanks,
SRK

7

You have spaces around %{SPACE} so that pattern will require at least two spaces in the [message] field. Remove the spaces.

8

HI, I tried removing the spaces but looks like not working. Do you mind giving me the right format? Thanks and appreciate your help.

9

I would expect

"%{GREEDYDATA:time}:%{NUMBER:timestamp}%{SPACE}%{GREEDYDATA:message}"

to match.

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.