ok good...many thanks for help
i have another problem
2017-07-13 13:32:32,562 | WARN | ...other words.. {"request":{"cks":31155,"terminal"....}
I can extract a line where there is a WARM but I also want to extract and process the Json that is there after {"request":{"cks":31155,"terminal"........}
I'm trying with this conf.
filter {
grok {
match => ["message", "(?<check>).*\| WARN \|.*(?<check_json>){\"request\".*}"]
break_on_match => true
add_field => {"type" => "log_warn"}
}
if !( "" in [check]){drop{}}
mutate { remove_field => ["path","host","check"]
add_tag => [ "WARNING" ] }
if "_grokparsefailure" in [tags] {drop {}}
else {
json {
source => "check_json"
}}
}
what do you think?