Help with logstash config

Elastic Stack Logstash
1

Hello,

I need some help in how we can parse logs in the following format. Have been trying using grok and csv but have not been able to parse the logs.

Any help will be really helpful.

{"ts":"2018-09-17T11:04:14.763","pid":27360,"tid":"69bc","sev":"info","req":"-","sess":"-","site":"{A07C2521-8B1E-4952-9FF1-F0E4AD54EC77}","user":"-","k":"begin-query","v":{"protocol-id":-1,"query":"SELECT ""."" AS ""\nFROM ""."" ""\n INNER JOIN ""."" "" ON ((""","query-category":"Unknown","query-hash":1449155313},"ctx":{"client-type":"dataserver","procid":"14888","requestID":"W5-CZWnpDdBwrsK9OUbR8gAAA@E","sessionid":"2B19A8A0D77E4C3AB34C81238C87F881-1:0","tid":"20548","username":"abc@temp.com"}}

2

That's a JSON string so you should use a json filter or possibly json or json_lines codec to parse it.

3

Thanks a lot! That helped.

I have another issue now, so for case where there is a json message inside a json message

The fields get split as
ctx.tid,
ctx.username
v.query-category
v.query-hash

and so on...

If i have to update any of the field or remove any of the field if i use ctx.tid or ctx.username it does now work

could you please help me with how to work with fields which are json within a json

4

Got it from your comments form another post by someone
had to access it as [v][query-category] and so on

Thanks again!

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.