How to grok parse a pipe | delimited string of key-value pairs (sorta like FIX)

Elastic Stack Logstash
1

Hello All,

I need to grok a pipe-delimited string of values in a grok line; for example:

|NAME=keith|DAY=wednesday|TIME=09:27:423227|DATE=08/06/2019|amount=68.23|currency=USD|etc...

What is the easiest way to do this? Some ideas I had:

  1. Some sort of grok split
  2. Custom Python parser. Filebeat strips off the log line, and forwards it to a Python script for processing
  3. Editing the source for Filebeat, looking for lines that contain strings like this, and parse them directly in Go
  4. Using the logstash-filter-fix_protocol on Github as a guide:
    https://github.com/connamara/logstash-filter-fix_protocol

Any guidance is appreciated.

Thanks,
Keith

2

I would use a kv filter.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.