How to check the tags values in logstash

[Sripal]

@magnusbeack

Could you please help me to fix this issue.

[wolfman (wolfman chen)]

noting the escape \
I don't understand why there are fewer escape characters.I obviously added the escape character \.

stdin { }
}

filter{
if[message] =~ /^\[.*/ {
grok {
match => ["message" ,'%{SYSLOG5424SD:cliip}, %{URIHOST:clientip} %{NOTSPACE:user} %{NOTSPACE:pass} %{NOTSPACE:role} \[%{HTTPDATE:logtime}\] \"%{WORD:method} %{DATA:request} HTTP/%{NUMBER:httpversion}\" %{NUMBER:responsecode} %{NUMBER:bitstransfer} %{NOTSPACE:id1} %{NOTSPACE:id2} %{NOTSPACE:id3} %{NOTSPACE:webserver} %{NOTSPACE:id5}']
}
}else{
grok {
match => ["message", '%{URIHOST:clientip} %{NOTSPACE:user} %{NOTSPACE:pass} %{NOTSPACE:role} \[%{HTTPDATE:logtime}\] \"%{WORD:method} %{DATA:request} HTTP/%{NUMBER:httpversion}\" %{NUMBER:responsecode} %{NUMBER:bitstransfer} %{NOTSPACE:id1} %{NOTSPACE:id2} %{NOTSPACE:id3} %{NOTSPACE:webserver} %{NOTSPACE:id5}']
}
}

}

output{
stdout {}
}

[Sripal]

Is this conf is working for you?

[wolfman (wolfman chen)]

yes,noting the escape character \

[Sripal]

Thanks @wolfman .

Somehow i managed the issue in my way, i am getting grokparsefailure error but logs are structured properly.
out of 35000 log line 32000 logs are structured

Thanks for the help