Help for parsing

Elastic Stack Logstash
1

Hello,
I'm trying to parse this log thanks to kv plugin:
[TXN_ID]: CO151231.2259.A38404[SERV]:CASHOUT[AMT]:2800[PR_MSISDN]:IND03

So i created a pattern as following:
VAR \[%{DATA}\]%{GREEDYDATA}

And my logstash config:

input {
    stdin{}
}

filter {
    grok {
        patterns_dir => "./patterns"
        match => ["message", "%{VAR:TOPARSE}%{VAR:TOPARSE}%{VAR:TOPARSE}%{VAR:TOPARSE}"]
    }

  kv {
        source => "TOPARSE"
        include_brackets => true
        value_split => ":"
  }
}

output {
  stdout {
    codec => rubydebug
  } 
}

The output:

{
       "message" => "[TXN_ID]: CO151231.2259.A38404[SERV]:CASHOUT[AMT]:2800[PR_MSISDN]:IND03",
      "@version" => "1",
    "@timestamp" => "2016-05-06T09:25:01.055Z",
          "host" => "christian-HP-Compaq",
       "TOPARSE" => [
        [0] "[TXN_ID]: CO151231.2259.A38404",
        [1] "[SERV]:CASHOUT",
        [2] "[AMT]:2800",
        [3] "[PR_MSISDN]:IND03"
    ],
        "TXN_ID" => "CO151231.2259.A38404",
          "SERV" => "CASHOUT",
           "AMT" => "2800",
     "PR_MSISDN" => "IND03"
}

So it's working well but I have to do in the grok "match" %{VAR:TOPARSE} four time. But in my logs the paramater's number can change so I tried to do %{VAR:TOPARSE}+ but it doesn't work.
Any ideas ? I'm sure it's easy but I can't find :confused:

Sincerely,
Chris.

2

Maybe you could try (%{VAR:TOPARSE})+ or (%{VAR:TOPARSE})*

3

I made some tests, and found a solution that works, without using grok at all :

kv {
  source => "message"
  value_split => ":"
  field_split => "\["
  trimkey => "\]"
}
4

Thanks a lot, it works fine :smiley:

5

Nice ! :slight_smile: