Grook Format For APM Nginx Log

i have format log like this, how logstash can make new field on elasticsearch for every this log, currently all log is in message field.

timestamp="25/Feb/2021:13:34:22 +0700" client= request="GET /api/Supir/Browse/JUMALI%20SIREGAR HTTP/1.0" request_length=1219 bytes_sent=296 body_bytes_sent=84 referer= user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.182 Safari/537.36" upstream_addr= upstream_status=200 request_time=0.175 upstream_response_time=0.176 upstream_connect_time=0.001 upstream_header_time=0.176

Use a kv filter. If there is a header on the line then remove it using dissect.

thanks , i will try it

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.