How do I add a field in my logs?

Elastic Stack Logstash
1

Hi,

im new in elastic stack and want to try out something. I have Pexip Logs below, my issue is that the duration is not recognized as a Field (in Kibana), I would like to have the duration value so i can calculate the average duration of the video calls and visualize it. Please help me. I got told that I need to ask here and that it has to do with the grok filter, what filter would I need for my logs?

Thanks in advance.

Logsample:
message:<134>Feb 27 21:58:03.439 newnode01 2018-02-27 21:58:03,439 Level="INFO" Name="administrator.conference" Message="Conference has been stopped." Conference="New VMR" Service-tag="" Service-type="conference" Duration="10.400" host:11.111.111.111 @timestamp:February 27th 2018, 22:58:03.440 @version:1 type:syslog _id:X9BF2WEBxgyqZgr-xOFI _type:mylogs _index:myindex _score: -

2

In order to use the Duration field as a number you need to create a mapping for your index which set the field to float. While you're at you can set the host field to type ip.

Not sure which version you are using but here is the doc:

3

Can you give me a put command for mapping my logs above, where do I set the command, in Kibana, DevTools?

4

Can you give me a put command for mapping my logs above, where do I set the command, in Kibana, DevTools?

Since you probably have daily or monthly indexes you'll want to set this via an index template.

As for how to parse the log in the first place, use a grok filter to extract timestamp, hostname etc, then use a kv filter to process the message part with the key="value" pairs.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.