# Log stash filter for Nagios service-performdata

**URL:** <https://discuss.elastic.co/t/log-stash-filter-for-nagios-service-performdata/120609>\
**Category:** Logstash\
**Created:** [February 20, 2018, 10:54am UTC](https://discuss.elastic.co/t/log-stash-filter-for-nagios-service-performdata/120609 "2018-02-20T10:54:31Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![charan.gandra](https://avatars.discourse-cdn.com/v4/letter/c/a87d85/32.png) [@charan.gandra](https://discuss.elastic.co/u/charan.gandra)\
**Post date:** [February 20, 2018, 10:54am UTC](https://discuss.elastic.co/t/log-stash-filter-for-nagios-service-performdata/120609/1 "2018-02-20T10:54:32Z")

</div>

Hi,

My Nagios service-perfdata is in below format and I am using filebeat to ship this log to Logstash.

DATATYPE::SERVICEPERFDATA TIMET::1519123537 HOSTNAME::DXCSRVMON11014 SERVICEDESC::Zombie Processes SERVICEPERFDATA::procs=0;5;10;0; SERVICECHECKCOMMAND::check\_nrpe!check\_zombie\_procs HOSTSTATE::UP HOSTSTATETYPE::HARD SERVICESTATE::OK SERVICESTATETYPE::HARD

Now, how do I automatically get fields for the rest of this log ? Is there a simple way to say : The thing before the "::" is the field name and the thing after is the value.

So I can obtain a JSON for elastic index with many fields for each log line :

```
{

    "HOSTNAME" => "localhost",
    "SERVICEDESC" => "Zombie Processes",
    "SERVICEPERFDATA" => "procs=0;5;10;0"
    "HOSTSTATE" => "UP",
   "SERVICESTATE" => "OK",
    etc,... 
}

```

Thanks for your help in advance

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 20, 2018, 8:52pm UTC](https://discuss.elastic.co/t/log-stash-filter-for-nagios-service-performdata/120609/2 "2018-02-20T20:52:17Z")

</div>

Use a kv filter.

---

<div class="post-metadata">

**Author:** ![charan.gandra](https://avatars.discourse-cdn.com/v4/letter/c/a87d85/32.png) [@charan.gandra](https://discuss.elastic.co/u/charan.gandra)\
**Post date:** [February 21, 2018, 9:29am UTC](https://discuss.elastic.co/t/log-stash-filter-for-nagios-service-performdata/120609/3 "2018-02-21T09:29:17Z")

</div>

Thank you very much. I've managed to get the fields in the format I needed. However is there anyway I can still parse this field after creating it?

Currentely my key value field for SERVICEPERFDATA is as below.

"SERVICEPERFDATA" =\> "procs=0;5;10;0"

But I would like out put as below.

"SERVICEPERFDATA" =\> 0

i.e. procs=0; 5; 10;0 neeed to be parsed so I can only get the actual value of procs which is 0 in this case.

Thanks for your help.

Here is my filter.

filter {  
kv {  
value\_split =\> "::"  
field\_split =\> "\t"  
trim\_value =\> ":"  
}  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 21, 2018, 10:10am UTC](https://discuss.elastic.co/t/log-stash-filter-for-nagios-service-performdata/120609/4 "2018-02-21T10:10:44Z")

</div>

You can process the SERVICEPERFDATA field with any filter. If you just want to remove everything from the first semicolon and onwards you can use a mutate filter's gsub option.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 21, 2018, 10:10am UTC](https://discuss.elastic.co/t/log-stash-filter-for-nagios-service-performdata/120609/5 "2018-03-21T10:10:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.