How to parse MQ consle output in logstash

IBMMQ3434
	SYSTEM.ADMIN.QMGR.EVENT                                  CURDEPTH(1) MAXDEPTH(3000)
	SYSTEM.AUTH.DATA.QUEUE                                   CURDEPTH(114) MAXDEPTH(999999999)
	SYSTEM.CHANNEL.SYNCQ                                     CURDEPTH(70) MAXDEPTH(20000)
	SYSTEM.CHLAUTH.DATA.QUEUE                                CURDEPTH(3000) MAXDEPTH(999999999)
	SYSTEM.CLUSTER.REPOSITORY.QUEUE                          CURDEPTH(299889) MAXDEPTH(999999999)
	SYSTEM.DURABLE.SUBSCRIBER.QUEUE                          CURDEPTH(188888899) MAXDEPTH(999999999)
	SYSTEM.HIERARCHY.STATE                                   CURDEPTH(278888) MAXDEPTH(999999999)

SYSTEM.RETAINED.PUB.QUEUE CURDEPTH(782) MAXDEPTH(999999999)

this is standard output from my AIX console output, i want to read this file

first line is queue Manger ,
second line will be queue name , its current depth or messages , maxdepth or threshold
or is there any plugin to read IBM MQ stats

Thanks
out to elastic should be like this below
{
queuemanger = "IBMMQ3434"
Queue name = "SYSTEM.RETAINED.PUB.QUEUE"
CurrentDepth = "782"
Maxdepth = "999999999"
}
{
queuemanger = "IBMMQ3434"
Queue name = "SYSTEM.HIERARCHY.STATE"
CurrentDepth = "278888"
Maxdepth = "999999999"
}

Thanks

If you consume that as a single event (e.g. using a multiline codec with a pattern that never matches plus auto_flush_interval) then you can parse it using

    grok { match => { "message" => "\A%{HOSTNAME:queueManager}
" } }
    split {}
    grok { match => { "message" => "\s*%{HOSTNAME:queue}\s*CURDEPTH\(%{POSINT:curdepth:int}\) MAXDEPTH\(%{POSINT:maxdepth:int}\)" } }
1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.