How can i filter this pattern?

Elastic Stack Logstash
1

Hi

I try to filter this

> \"tenantID\": 80334, \"Size\": 11.42, \"FirstDate\": \"15/03/2020 00:09:47\", \"LastDate\": \"15/03/2020 23:59:17\"

i need this:

tenantID: 80334
Size: 11.42
FirstDate: 15/03/2020 00:09:47
LastDate: 15/03/2020 23:59:17

But i don't know how to do a patter that grook filter data that indicate in black.

Can you help me? I tried a lot of times but i don't know how to get all data that i need with grok. Thanks for advanced!

2

Hello there,

what you want to do does not sound difficult (if I got it right) but can you please post here ( properly spaced and formatted ) the output of the following pipeline first?

input {
  whatever your input is
}

filter {}

output {
  stdout{}
}

I'd like to see what your logs look like to logstash. Thanks

3

Hi

Thanks for respond.

This is the output of pipeline show for terminal:

\"tenantID\": 80334, \"Size\": 11.42, \"FirstDate\": \"15/03/2020 00:09:47\", \"LastDate\": \"15/03/2020 23:59:17\"

All of this

4

Hi there,

this cannot be the output of the terminal since you should have something like:

{
  "@version" => "..."
  "@timestamp" => "..."
  "message" => "..."
  etc...
}
5 
 {
logstash         |     "message" => "{\"tenantID\": 81183, \"Size\": 8.54, \"FirstDate\": \"14/03/2020 07:12:18\", \"LastDate\": \"14/03/2020 11:42:09\"}"
logstash         | }

I have a mutate that remove @timestampt etc...
Thanks for your help!

6

Ok so, if your message is a perfect json, try this:

input {
  stdin{}
}

filter {
  json {
    source => "message"
  }
}

output {
  stdout{}
}

You should get something like the following:

{
      "LastDate" => "14/03/2020 11:42:09",
      "tenantID" => 81183,
     "FirstDate" => "14/03/2020 07:12:18",
       "message" => "{\"tenantID\": 81183, \"Size\": 8.54, \"FirstDate\": \"14/03/2020 07:12:18\", \"LastDate\": \"14/03/2020 11:42:09\"}",
          "Size" => 8.54
}

NOTE: obviously I meant the filter section, that one is the exact pipeline I used to test your input, setting as input {"tenantID": 81183, "Size": 8.54, "FirstDate": "14/03/2020 07:12:18", "LastDate": "14/03/2020 11:42:09"}

7

It works, thanks!!!! :sob: :sob: :sob:

8

No problem. I only ask you to mark my answer as a solution, so future readers will see this thread has been solved.

Thanks.

9

Do it. Thanks!

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.