How do i aggregate the same event in the message field

Elastic Stack Logstash
1

this is my json log file,I want to group the error logged event from the message field, and one more thing what is the pattern of the message field

[{
"logID": 1,
"organizationID": 1,
"userID": 1001,
"appID": 123,
"moduleID": 1,
"screenID": 213,
"timeStamp": "2017-03-15 10:06:26",
"action": "Login",
"purpose": "log",
"role": "Doctor",
"location": "Hospital",
"ipaddress": "192.168.1.3",
"networkType": "desktop",
"method": "getAll",
"category": "normal",
"description": "successfully logged in"
}, {
"logID": 2,
"organizationID": 1,
"userID": 201,
"appID": 201,
"moduleID": 2,
"screenID": 224,
"timeStamp": "2017-03-15 10:36:06",
"action": "Login",
"purpose": "log",
"role": "Nurse",
"location": "Clinic",
"ipaddress": "192.168.2.6",
"networkType": "tablet",
"method": "addVitals",
"category": "minor error",
"description": "error logged"
}, {
"logID": 3,
"organizationID": 1,
"userID": 1245,
"appID": 654,
"moduleID": 2,
"screenID": 225,
"timeStamp": "2017-03-15 10:46:26",
"action": "Book_apt",
"purpose": "log",
"role": "Patient",
"location": "public",
"ipaddress": "192.178.1.5",
"networkType": "mobile",
"method": "getByID",
"category": "severe error",
"description": "error logged"
}, {
"logID": 4,
"organizationID": 1,
"userID": 1001,
"appID": 123,
"moduleID": 1,
"screenID": 213,
"timeStamp": "2017-03-15 11:16:26",
"action": "Logout",
"purpose": "log",
"role": "Doctor",
"location": "Hospital",
"ipaddress": "192.168.1.3",
"networkType": "desktop",
"method": "getAll",
"category": "normal",
"description": "successfully logged out"
}, {
"logID": 5,
"organizationID": 1,
"userID": 2365,
"appID": 321,
"moduleID": 3,
"screenID": 654,
"timeStamp": "2017-03-15 11:56:36",
"action": "Find_doctor",
"purpose": "log",
"role": "Patient",
"location": "public",
"ipaddress": "192.178.6.8",
"networkType": "desktop",
"method": "getByName",
"category": "normal",
"description": "Doctor found"
}, {
"logID": 6,
"organizationID": 1,
"userID": 201,
"appID": 201,
"moduleID": 2,
"screenID": 224,
"timeStamp": "2017-03-15 12:06:36",
"action": "Login",
"purpose": "log",
"role": "Nurse",
"location": "Clinic",
"ipaddress": "192.168.2.6",
"networkType": "tablet",
"method": "updateVitals",
"category": "minor error",
"description": "error logged"
}, {
"logID": 7,
"organizationID": 1,
"userID": 1,
"appID": 254,
"moduleID": 5,
"screenID": 986,
"timeStamp": "2017-03-15 12:30:46",
"action": "Health_FAQ",
"purpose": "log",
"role": "Patient",
"location": "public",
"ipaddress": "192.178.5.7",
"networkType": "mobile",
"method": "getAll",
"category": "normal",
"description": "New FAQ added"
}, {
"logID": 8,
"organizationID": 1,
"userID": 215,
"appID": 666,
"moduleID": 2,
"screenID": 226,
"timeStamp": "2017-03-15 12:46:59",
"action": "Book_apt",
"purpose": "log",
"role": "Patient",
"location": "public",
"ipaddress": "192.178.5.7",
"networkType": "mobile",
"method": "getByID",
"category": "severe error",
"description": "error logged"
}, {
"logID": 9,
"organizationID": 1,
"userID": 23,
"appID": 654,
"moduleID": 4,
"screenID": 224,
"timeStamp": "2017-03-15 01:16:23",
"action": "View_patient_Records",
"purpose": "AUDIT",
"role": "Doctor",
"location": "Clinic",
"ipaddress": "192.178.8.2",
"networkType": "mobile",
"method": "getAll",
"category": "normal",
"description": "All patients record viewed"
}, {
"logID": 10,
"organizationID": 1,
"userID": 65,
"appID": 145,
"moduleID": 1,
"screenID": 333,
"timeStamp": "2017-03-15 01:26:45",
"action": "View_stock",
"purpose": "AUDIT",
"role": "Doctor",
"location": "Clinic",
"ipaddress": "192.188.7.1",
"networkType": "mobile",
"method": "getAll",
"category": "normal",
"description": "All substances record viewed"
}]

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.