How to Parse App Log from Apache nifi

Elastic Stack Logstash
2

You can use something like this:

%{DATE:date} %{TIME:time} %{WORD:EventType} %{GREEDYDATA:EventText}

You will have a field with the date in the format yy-mm-dd, a field with the time, a field with the event type and a field with the rest of the message.

LIke this:

{
  "date": [
    "17-07-28"
  ],
  "time": [
    "11:40:00,256"
  ],
  "EventType": [
    "WARN"
  ],
  "EventText": [
    "[Timer-Driven Process Thread-7] o.a.h.c.protocol.ResponseProcessCookies Invalid cookie header: "set-cookie: guest_id=v1%3A150125640009836952; Expires=Sun, 28 Jul 2019 15:40:00 UTC; Path=/; Domain=.twitter.com". Invalid 'expires' attribute: Sun, 28 Jul 2019 15:40:00 UTC"
  ]
}

You can test grok patterns using grok debug or if you have Kibana 5.5 with X-Pack, it's a new feature.