Hi,
My Nagios service-perfdata is in below format and I am using filebeat to ship this log to Logstash.
DATATYPE::SERVICEPERFDATA TIMET::1519123537 HOSTNAME::DXCSRVMON11014 SERVICEDESC::Zombie Processes SERVICEPERFDATA::procs=0;5;10;0; SERVICECHECKCOMMAND::check_nrpe!check_zombie_procs HOSTSTATE::UP HOSTSTATETYPE::HARD SERVICESTATE::OK SERVICESTATETYPE::HARD
Now, how do I automatically get fields for the rest of this log ? Is there a simple way to say : The thing before the "::" is the field name and the thing after is the value.
So I can obtain a JSON for elastic index with many fields for each log line :
{
"HOSTNAME" => "localhost",
"SERVICEDESC" => "Zombie Processes",
"SERVICEPERFDATA" => "procs=0;5;10;0"
"HOSTSTATE" => "UP",
"SERVICESTATE" => "OK",
etc,...
}
Thanks for your help in advance