Kv Filter is not working

(adansar) #1


I had a problem while parsing some logs, example :

2018-01-26 13:05:36.072Z ERROR [Camel (context-autoprov) thread #2 - JmsConsumer[inject]] n.a.cle.business.PairingAutoProcess - [PL-MROV-002][RO:REM_JUnit_2][XIN:Xin#!&] XIN is not alphanum in [XIN:xin#!&]

2018-02-13 13:16:21.301Z ERROR [Camel (context-autoprov) thread #1 - JmsConsumer[inject]] n.a.cle.business.PairingAutoProcess - [PL-MROV-007][RO:Remote_N_5050000000000009][XIN:XINTEST][OrderId:158528542] Could not notify the other side for pairing response

2018-02-13 13:16:21.291Z ERROR ContextID=NO_CONTEXT [http-bio-8098-exec-3] n.a.c.s.e.m.w.i.MROVServiceImpl - [PL_MROV-085][ROS:[Remote_N_5050000000000009]] Call Send Generic Command (XLT webservice), failed - error : org.apache.cxf.service.factory.ServiceConstructionException: Failed to create service.

I tried that pattern :

%{TIMESTAMP_ISO8601:log_date} %{LOGLEVEL:log_level} %{GREEDYDATA:context} - [%{DATA:error_code}][%{GREEDYDATA:XY}] %{GREEDYDATA:msg}

Then i use the logstash module kv this way :

if [XY]{
#parse "XY" field with key value
kv {
source => "XY"
field_split => "]["
value_split => ":"
include_brackets => false

I had a problem in field_split and i corrected it, I forgot to put "" before brackets.

But even after that correction, I don't even these logs on kibana, while i'm getting all the other logs.

Thank you in advance.


(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.