i have format log like this, how logstash can make new field on elasticsearch for every this log, currently all log is in message field. timestamp="25/Feb/2021:13:34:22 +0700" client=192.168.0.21 request="GET /api/Supir/Browse/JUMALI%20SIREGAR HTTP/1.0" request_length=1219 bytes_sent=296 body_bytes…

Grook Format For APM Nginx Log

Badger February 25, 2021, 4:38pm 2

Use a kv filter. If there is a header on the line then remove it using dissect.

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.