Again I change logstash filter.conf
filter {
grok {
match => { "message" => "@timestamp:%{DATA:ts} host:%{DATA:host} source:%{DATA:source} operator:%{DATA:operator} message:[%{DATA:level}] status => %{DATA:what} | client : [%{DATA:client}] " }
}
mutate {
remove_field => [ "type", "tags", "input_type", "@version", "beat", "offset"]
}
}
discovery logs:
@timestamp: August 27th 2017, 15:33:50.603
t host: vNTDACLSnTALK01
t message: log-level : [INFO ], status : [FAIL], client : [IPDC], cell : [1746710009], message_delivery_time : [2017-08-14 09:46:27,807], operator: [ROBI]
t source: /home/local/group/nazdaq/logs/naztech.log
but don't show field:
status
client
operator
message-delivery-time
So I need help
Thanks