I cannot tell what you expect to extract from this data; can you provide a mapping of what keys you expect to extract, and what you expect the values to be, exactly?
There was recently a new release of the kv filter plugin, which allows us to specify a pattern for the field-splitter and value-splitter; the following may work, but it will not be especially performant because it will need to do a lot of backtracking in order to capture the right bits:
bin/logstash-plugin update logstash-filter-kv
Once you have done so, we can define the pattern to split fields on one of the following:
- the start of a string followed by an open-square-bracket
^\[ (cheap); OR
- a close-square-bracket followed by the end-of-line
\]$ (cheap); OR
- a close-suare-bracket and open-square-bracket that is followed by something that looks like a key
\]\[(?=[A-Za-z0-9]+=)) (expensive; may need to backtrack)
Put it together, and we get:
filter {
kv {
field_split_pattern => "(?:^\[|\]$|\]\[(?=[A-Za-z0-9]+=))"
}
}
With the above pattern, I get:
{
"source" => "Internal",
"host" => "castrovel.local",
"success" => "True",
"durationConversion" => "0",
"size" => "118784",
"durationExecution" => "328",
"converter" => "_FilenameToHtmlNoBlob",
"@timestamp" => 2018-03-29T18:43:20.270Z,
"guid" => "D2B636B35A54433AB2916FEA4D180538",
"fileext" => "xls",
"durationExts" => "0",
"durationLemma" => "16",
"event-type" => "indexation",
"durationIndexPacket" => "0",
"@version" => "1",
"message" => "ok",
"durationCache" => "16",
"filename" => "0_1d1ea[**R4][**]2011-05-25 Rumsf=f600rdelning Byggnad_Plan_Rum.xls"
}