Kv Filter is not working


I had a problem while parsing some logs, example :

2018-01-26 13:05:36.072Z ERROR [Camel (context-autoprov) thread #2 - JmsConsumer[inject]] n.a.cle.business.PairingAutoProcess - [PL-MROV-002][RO:REM_JUnit_2][XIN:Xin#!&] XIN is not alphanum in [XIN:xin#!&]

2018-02-13 13:16:21.301Z ERROR [Camel (context-autoprov) thread #1 - JmsConsumer[inject]] n.a.cle.business.PairingAutoProcess - [PL-MROV-007][RO:Remote_N_5050000000000009][XIN:XINTEST][OrderId:158528542] Could not notify the other side for pairing response

2018-02-13 13:16:21.291Z ERROR ContextID=NO_CONTEXT [http-bio-8098-exec-3] n.a.c.s.e.m.w.i.MROVServiceImpl - [PL_MROV-085][ROS:[Remote_N_5050000000000009]] Call Send Generic Command (XLT webservice), failed - error : org.apache.cxf.service.factory.ServiceConstructionException: Failed to create service.

I tried that pattern :

%{TIMESTAMP_ISO8601:log_date} %{LOGLEVEL:log_level} %{GREEDYDATA:context} - [%{DATA:error_code}][%{GREEDYDATA:XY}] %{GREEDYDATA:msg}

Then i use the logstash module kv this way :

if [XY]{
#parse "XY" field with key value
kv {
source => "XY"
field_split => "]["
value_split => ":"
include_brackets => false

I had a problem in field_split and i corrected it, I forgot to put "" before brackets.

But even after that correction, I don't even these logs on kibana, while i'm getting all the other logs.

Thank you in advance.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.