Help on creating GROK patterns

Elastic Stack Logstash
6

Using your log example I would try something like this.

%{MONTHDAY} %{MONTH} %{YEAR} %{TIME},%{NUMBER:duration} %{WORD:loglevel} %{WORD:Activity} \[\{%{DATA:foo1}\}\]:(.*) execution time: %{NUMBER:executionTime} ms

Using that I get this result in the grok tester website.

image
image.png1117×279 38.7 KB

Once you have your key value pairs into it's own field you can use the KV filter to dynamically split them up even more so. Something like this:

kv {
   source => "foo1"
   field_split => ","
   prefix => "foo_"
}