Log4Net

Hi,
I just installed LogStash using these steps (https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-7)

Now, I need to parse my log4net's logs.

I want each fields to be indexed in his own field, like Level=ERROR.

I'm using filebeat to send my log files from Windows to logstash.

I can't change my application's log4net config

Can anyone help me?

eg.
2017-05-19 04:00:02,349 UTC ThreadID=[Worker #04c4ee00] Level=ERROR Logger=Hangfire.AutomaticRetryAttribute Failed to process the job '26934': an exception occurred.
Hangfire.Storage.DistributedLockTimeoutException: Timeout expired. The timeout elapsed prior to obtaining a distributed lock on the 'HangFire:AzureTranslationCachingJob.Execute' resource.
at Hangfire.SqlServer.SqlServerDistributedLock.Acquire(IDbConnection connection, String resource, TimeSpan timeout)
at Hangfire.SqlServer.SqlServerDistributedLock..ctor(SqlServerStorage storage, String resource, TimeSpan timeout)
at Hangfire.SqlServer.SqlServerConnection.AcquireDistributedLock(String resource, TimeSpan timeout)
at Hangfire.DisableConcurrentExecutionAttribute.OnPerforming(PerformingContext filterContext)
at Hangfire.Server.BackgroundJobPerformer.InvokePerformFilter(IServerFilter filter, PerformingContext preContext, Func`1 continuation)

For now, all fields is indexed in message.

Use a grok filter to extract fields as desired. If you're unfamiliar with regular expressions the grok constructor web site can help you get started.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.