Hello,
I had a problem while parsing some logs, example :
2018-01-26 13:05:36.072Z ERROR [Camel (context-autoprov) thread #2 - JmsConsumer[inject]] n.a.cle.business.PairingAutoProcess - [PL-MROV-002][RO:REM_JUnit_2][XIN:Xin#!&] XIN is not alphanum in [XIN:xin#!&]
2018-02-13 13:16:21.301Z ERROR [Camel (context-autoprov) thread #1 - JmsConsumer[inject]] n.a.cle.business.PairingAutoProcess - [PL-MROV-007][RO:Remote_N_5050000000000009][XIN:XINTEST][OrderId:158528542] Could not notify the other side for pairing response
2018-02-13 13:16:21.291Z ERROR ContextID=NO_CONTEXT [http-bio-8098-exec-3] n.a.c.s.e.m.w.i.MROVServiceImpl - [PL_MROV-085][ROS:[Remote_N_5050000000000009]] Call Send Generic Command (XLT webservice), failed - error : org.apache.cxf.service.factory.ServiceConstructionException: Failed to create service.
I tried that pattern :
%{TIMESTAMP_ISO8601:log_date} %{LOGLEVEL:log_level} %{GREEDYDATA:context} - [%{DATA:error_code}][%{GREEDYDATA:XY}] %{GREEDYDATA:msg}
Then i use the logstash module kv this way :
if [XY]{
#parse "XY" field with key value
kv {
source => "XY"
field_split => "]["
value_split => ":"
include_brackets => false
}
}
I had a problem in field_split and i corrected it, I forgot to put "" before brackets.
But even after that correction, I don't even these logs on kibana, while i'm getting all the other logs.
Thank you in advance.
Regards.