How to grok parse a pipe | delimited string of key-value pairs (sorta like FIX)

Hello All,

I need to grok a pipe-delimited string of values in a grok line; for example:


What is the easiest way to do this? Some ideas I had:

  1. Some sort of grok split
  2. Custom Python parser. Filebeat strips off the log line, and forwards it to a Python script for processing
  3. Editing the source for Filebeat, looking for lines that contain strings like this, and parse them directly in Go
  4. Using the logstash-filter-fix_protocol on Github as a guide:

Any guidance is appreciated.


I would use a kv filter.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.