I want to create grok pattern for custom log

Following is a log-pattern and I tried creating one but it didn't work.


2020-04-07	00:00:02	Local0	Info	00:00:01:911	DMSTST-TBOX.DEV.cloud.companyname.com	DEV\DMSTST-TBOX$|17352|DICOM Service	VMSDBD_SVC_DICOM	008940/Remote Implementation Class UID: '', Implementation Version Name: 'OFFIS_DCMTK_363'


%{TIMESTAMP_ISO8601:date} \t %{KEYWORD:typedata} %{KEYWORD:loglevel} %{GREEDYDATA} %{KEYWORD:host} %{KEYWORD:serviceinfo} %{KEYWORD:component} %{TEXT:messagefield}

Can anyone help me with this?

How have you defined the KEYWORD pattern?

I am using KEYWORD as datatype mapping.

A grok pattern and an elasticsearch mapping are unrelated concepts.

I just want to create grok for tab separated field but I don't know ho to do that...even I tried with grok constructor but seems tab is not working.

You can just use a literal tab in the pattern.

SERVMSG %{GREEDYDATA:serviceinfo}\t\t%{GREEDYDATA:message}|%{GREEDYDATA:message}

works well.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.