I want to create grok pattern for custom log

Elastic Stack Logstash
1

Hi,
Following is a log-pattern and I tried creating one but it didn't work.

Log:

2020-04-07	00:00:02	Local0	Info	00:00:01:911	DMSTST-TBOX.DEV.cloud.companyname.com	DEV\DMSTST-TBOX$|17352|DICOM Service	VMSDBD_SVC_DICOM	008940/Remote Implementation Class UID: '1.2.276.0.7230010.3.0.3.6.3', Implementation Version Name: 'OFFIS_DCMTK_363'

Pattern:

%{TIMESTAMP_ISO8601:date} \t %{KEYWORD:typedata} %{KEYWORD:loglevel} %{GREEDYDATA} %{KEYWORD:host} %{KEYWORD:serviceinfo} %{KEYWORD:component} %{TEXT:messagefield}

Can anyone help me with this?

2

How have you defined the KEYWORD pattern?

3

I am using KEYWORD as datatype mapping.

4

A grok pattern and an elasticsearch mapping are unrelated concepts.

5

I just want to create grok for tab separated field but I don't know ho to do that...even I tried with grok constructor but seems tab is not working.

6

You can just use a literal tab in the pattern.

7 
%{TIMEFORMAT:eventtime}\t%{WORD:typedata}\t%{WORD:loglevel}\t%{GREEDYDATA}\t%{GREEDYDATA:host}\t%{SERVMSG}

TIMEFORMAT %{YEAR}-%{MONTHNUM}-%{MONTHDAY}\t%{TIME}
SERVMSG %{GREEDYDATA:serviceinfo}\t\t%{GREEDYDATA:message}|%{GREEDYDATA:message}

works well.
Thanks.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.