How to dissect uneven space in log with filebeat processors

Elastic Stack Beats
1

Hey all, I have a python microservice that output logs like so:

INFO    ; 2022-12-02 01:30:00; bla bla bla...
DEBUG   ; 2022-12-02 01:30:00; bla bla bla...

Note how the space is different on the loglevel.
I am parsing it like so:

                    - dissect:
                        tokenizer: "%{log.level}    ;%{+timestamp} ; %{?message}"
                        field: "message"
                        target_prefix: ""

Which work for the first line, not the second.
Anyone know if there is a solution for such case?

Thank you.

2

Hi @amir_Bialek

Think you want to look at the more detailed docs on dissect.
This is from the ingest processor but I am pretty sure all the syntax holds true

Skip right padding

-> Skip right padding (far) right %{keyname1->} Skips any repeated characters to the right link

So perhaps something like BTW you have a space after the ; you need to account for

tokenizer: "%{log.level->}; %{+timestamp}; %{?message}"

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.