my concern is all debug information i want to save in DEBUG.log and all info log information need to be save in INFO.log file. but that one is not happening. all the debug , info ,etc logging information stored in MO.log file . could you please help me on this anything i did wrong
{"message":"2018-07-25_16:57:48.39018 consul 2018/07/25 11:57:48 [DEBUG] agent: Service 'consul' in sync\n","@version":"1","crs":"consul","mms":" 2018/07/25 11:57:48 [DEBUG] agent: Service 'consul' in sync\n","host":"205.26.198.10","ts":"2018-07-25_16:57:48.39018","@timestamp":"2018-07-25T16:57:48.389Z"}
Is that what a line of the log file looks like? If so, it is not even close to matching your grok filter. It has a timestamp that I would not expect to match %{SYSLOGTIMESTAMP} followed by a hostname and a second timestamp.
Build your grok filter one field at a time and make sure the first part matches before adding additional fields.
And for that format dissect is probably better than grok.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.