I just installed LogStash using these steps (https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-7)

Now, I need to parse my log4net's logs.

I want each fields to be indexed in his own field, like Level=ERROR.

I'm using filebeat to send my log files from Windows to logstash.

I can't change my application's log4net config

Can anyone help me?

2017-05-19 04:00:02,349 UTC ThreadID=[Worker #04c4ee00] Level=ERROR Logger=Hangfire.AutomaticRetryAttribute Failed to process the job '26934': an exception occurred.
Hangfire.Storage.DistributedLockTimeoutException: Timeout expired. The timeout elapsed prior to obtaining a distributed lock on the 'HangFire:AzureTranslationCachingJob.Execute' resource.
at Hangfire.SqlServer.SqlServerDistributedLock.Acquire(IDbConnection connection, String resource, TimeSpan timeout)
at Hangfire.SqlServer.SqlServerDistributedLock..ctor(SqlServerStorage storage, String resource, TimeSpan timeout)
at Hangfire.SqlServer.SqlServerConnection.AcquireDistributedLock(String resource, TimeSpan timeout)
at Hangfire.DisableConcurrentExecutionAttribute.OnPerforming(PerformingContext filterContext)
at Hangfire.Server.BackgroundJobPerformer.InvokePerformFilter(IServerFilter filter, PerformingContext preContext, Func`1 continuation)

For now, all fields is indexed in message.

(Magnus B├Ąck) #2

Use a grok filter to extract fields as desired. If you're unfamiliar with regular expressions the grok constructor web site can help you get started.

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.