How to calculate first pass logic and reren for testcase using logstash grok

[aish794726]

am working on grok, have very few knowledge about it, we are preparing regression dashboard there we need first pass and reren so that system should understand, these script got pass infirst these are fail n might required rerun, here is my logic..but ELK is new to me we want this syntax using grok,logstash here is the formula

First pass logic --> total TC-first run passed TC/total TC * 100

Rerun--> rerun =(prevRun* prevPass + passPerc)/(prevRun + 1)

[Christian_Dahlqvist]

Grok is used to parse string data into fields. It is not clear to me how grok is related to what you are describing.it would be useful if you could elaborate more and privide an exame of what the data looks like and what you are looking to achieve with this.

[aish794726]

hi team this is taken as input

input {
file {
path => "/root/logs/logs/0001_ipos_nightly_evr_td_031321_182638.log"
start_position => "beginning"
sincedb_path => "/dev/null"
type => "log"
}
file {

     path => "/root/logs/0001_ipos_nightly_evr_td_031321_182638.result"
     #path => "/root/logs/*.result"
     codec => multiline {
     pattern => "^#"
                negate => true
                what => "next"
            }
     start_position => "beginning"
     sincedb_path => "/dev/null"
     type => "result"

}
}

filter {
if [type] == "log" {
grok {
match => { "message" => "\\s%{DATA:timestamp}\sLOG\s\\sCHECK\s%{DATA:Chck_num}\s:\s*...\s*%{WORD:status}\s*...\s*%{GREEDYDATA:checkpoint}" }
add_field => { "index" => "TESTCASE" }
add_field => { "taskid" => "TESTCASE_LOG" }
}
if "_grokparsefailure" in [tags] {
grok{
match => { "message" => "Start Time:\s*%{GREEDYDATA:script_start_time}" }
match => { "message" => "Script\sName:\s%{GREEDYDATA:script_path}"}
match => { "message" => "Machine Name \s*:\s*%{GREEDYDATA:server_name}"}
match => { "message" => "DEVICE\d+=%{GREEDYDATA:devices}\sDEVICE\d+=%{GREEDYDATA:devices}\sDEVICE\d+=%{GREEDYDATA:devices}"}
add_field => { "index" => "TESTSCRIPT" }
add_field => { "taskid" => "TESTSCRIPT_LOG" }
remove_tag => ["_grokparsefailure"]
}
}
aggregate {
task_id => "%{taskid}"

[Christian_Dahlqvist]

What does the data in the file look like? What is the output you are looking to achieve?

[aish794726]

Hi Christian,
please find my inputi files

{"errors":"0","log":{"file":{"path":"/root/logs/0015_ha_l3vpn_ldp_ospf_backbone_part1_031321_200626.result.xml"}},"index":["TESTCASE","TESTSCRIPT"],"fail":"0","skip":"0","time":"2491","tests":"1","type":"resultx"}
{"dut_type":"EVR_VMWARE","log":{"file":{"path":"/root/logs/0015_ha_l3vpn_ldp_ospf_backbone_part1_031321_200626.result.xml"}},"index":["TESTCASE","TESTSCRIPT"],"type":"resultx"}
{"Time":"13MAR2021 18h33m48s","testcasenum":"8","log":{"file":{"path":"/root/logs/0001_ipos_nightly_evr_td_031321_182638.result"}},"index":"TESTSCRIPT","testcase":"Verify OSPF Nbrs and Routes in mcast context","STATUS":"PASS","type":"result"}
{"Time":"13MAR2021 18h34m32s","testcasenum":"18","log":{"file":{"path":"/root/logs/0001_ipos_nightly_evr_td_031321_182638.result"}},"index":"TESTSCRIPT","testcase":"Verify ICR State","STATUS":"PASS","type":"result"}
{"Time":"13MAR2021 18h34m42s","testcasenum":"22","log":{"file":{"path":"/root/logs/0001_ipos_nightly_evr_td_031321_182638.result"}},"index":"TESTSCRIPT","testcase":"Verify RSVP Sanity","STATUS":"PASS","type":"result"}
{"Time":"13MAR2021 18h34m52s","testcasenum":"25","log":{"file":{"path":"/root/logs/0001_ipos_nightly_evr_td_031321_182638.result"}},"index":"TESTSCRIPT","testcase":"Verify ip route summary in all contexts","STATUS":"PASS","type":"result"}
{"Time":"13MAR2021 18h35m23s","testcasenum":"38","log":{"file":{"path":"/root/logs/0001_ipos_nightly_evr_td_031321_182638.result"}},"index":"TESTSCRIPT","testcase":"BGP Diverse Path Verification","STATUS":"PASS","type":"result"}
{"Time":"13MAR2021 18h35m27s","testcasenum":"40","log":{"file":{"path":"/root/logs/0001_ipos_nightly_evr_td_031321_182638.result"}},"index":"TESTSCRIPT","testcase":"BGP Multi Path Verification","STATUS":"PASS","type":"result"}
{"Time":"13MAR2021 18h35m38s","testcasenum":"41","log":{"file":{"path":"/root/logs/0001_ipos_nightly_evr_td_031321_182638.result"}},"index":"TESTSCRIPT","testcase":"TC38 Ping test","STATUS":"PASS","type":"result"}
{"script_path":"/project/iposarts/iposr6k/IPOS-TP/ipostest/ARTS/tests/IPOS/EVR-TD/nightly/ipos_nightly_lsv_evr_td/ipos_nightly_evr_td/ipos_nightly_evr_td","log":{"file":{"path":"/root/logs/logs/0001_ipos_nightly_evr_td_031321_182638.log"}},"index":"TESTSCRIPT","type":"log"}
{"dut_type":"EVR_VMWARE","log":{"file":{"path":"/root/logs/0004_FT17658_ldp_hardening_031321_183241.result.xml"}},"index":["TESTCASE","TESTSCRIPT"],"type":"resultx"}

These all are input from my testscipt, so some of them will pass in first run some might need rerun, how do I write program form that, if you could help here please