How to parse mix json logs


#21

Test the format before parsing...

    dissect { mapping => { "message" => "%{ts} %{+ts} | %{restOfLine}" } }
    if [restOfLine] =~ /{.*}/ {
        json { source => "restOfLine" }
    } else if [restOfLine] =~ /\[.*\]/ {
        mutate { gsub => [ "restOfLine", "^\[", "", "restOfLine", "\]$", "" ] }
        csv { source => "restOfLine" }
    } else {
        # Handle other format
    }

(Amol) #22

Thank you so much for your kind help its working.but i am getting mutiple fields named column in kibana why this is so,could you please explain me.i am adding screen short of it here

if it is not necessary could we remove this.


#23

I assumed you wanted to parse that as a csv. If you do not supply the column names the csv will generate them.


(Amol) #24

ok got it,Thank you Bader.