How to parse more similar fields with Logstash?

[Francesca_P]

Hi,
I'm new with Logstash. I'm trying to parse a log file that contain the following fields:

2017-02-02 07:19:16,908 [varMes: <audio source="au/speak1.wav" />
<audio source="au/speak2.wav" /> <audio source="au/speak3.wav" />
<audio source="au/speak4.wav" />]

2017-02-02 07:19:17,812 [varMes: &lt;audio source="au/speak1.wav" /&gt;
&lt;audio source="au/speak2.wav" /&gt;]

I would like to load them both in the same ES Index, but it does not work with just the grok filter. I can't understand how to manage the various fields.

Please, any help on how to load it?

[eperry (Ed)]

This is always a tough issue to deal with. Grok while incredibly powerful occasionally has limits. I have never found a good answer to deal with this. But there are options.

Here is an old article for one way to do it

How do we match multiple random ips?

If you're okay with getting all IPs in an array field you can just use grok extract all the IPs to a string and use the mutate filter to split that string. filter { grok { match => ["message", "^(?<ip>%{IP}(, %{IP})*) ..."] } mutate { split => ["ip", ", "] } } It looks like you might always have at least two IPs, each followed by a space, followed by a comma-separated list of IPs. In that you'll have to adjust the filters a bit but it shouldn't be too hard.

another would be to do it in the ruby filter

Ruby filter plugin | Logstash Reference [8.11] | Elastic

A final option might be to use the KV filter as all your data is in "source=file"

Kv filter plugin | Logstash Reference [8.11] | Elastic