Help with logstash config



I need some help in how we can parse logs in the following format. Have been trying using grok and csv but have not been able to parse the logs.

Any help will be really helpful.

{"ts":"2018-09-17T11:04:14.763","pid":27360,"tid":"69bc","sev":"info","req":"-","sess":"-","site":"{A07C2521-8B1E-4952-9FF1-F0E4AD54EC77}","user":"-","k":"begin-query","v":{"protocol-id":-1,"query":"SELECT ""."" AS ""\nFROM ""."" ""\n INNER JOIN ""."" "" ON ((""","query-category":"Unknown","query-hash":1449155313},"ctx":{"client-type":"dataserver","procid":"14888","requestID":"W5-CZWnpDdBwrsK9OUbR8gAAA@E","sessionid":"2B19A8A0D77E4C3AB34C81238C87F881-1:0","tid":"20548","username":""}}

(Magnus B├Ąck) #2

That's a JSON string so you should use a json filter or possibly json or json_lines codec to parse it.


Thanks a lot! That helped.

I have another issue now, so for case where there is a json message inside a json message

The fields get split as

and so on...

If i have to update any of the field or remove any of the field if i use ctx.tid or ctx.username it does now work

could you please help me with how to work with fields which are json within a json


Got it from your comments form another post by someone
had to access it as [v][query-category] and so on

Thanks again!

(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.