Logmessage map to tags or fields

[jayaram (Jay)]

Continuing the discussion from Any Help Un-structure log message to map structure message in Logstash:

@jayaram

Hello, I have the log message
2015-11-18 21:11:38,693 [WARN ] [xx.web.common.filter.RequestFilter] NDC[UserPrincipal(ABCDF22602)] request (/member/control/loginAction) exceeded threshold; elapsed milliseconds since start: 188814

Can any one help me. How to tag or map the each same stored/moved to elasticsearch or any output resource

dose GROK plugin help for this mapping? any other plugin available to map/associate the each value to some TAG
I am trying like this in grok plugin but not working

match => { "timestamp" => "%{TOMCAT_DATESTAMP:timestamp}"}
match => { "level" => "[%{LOGLEVEL:level}]" }
match => { "class" => "[%{JAVACLASS:class}]" }
match => { "logmessage" => "%{JAVALOGMESSAGE:logmessage}" }

[magnusbaeck (Magnus Bäck)]

This is a Logstash question so I'm not sure why you want to continue the discussion in the Elasticsearch group.

[jayaram (Jay)]

i thought it stored in elasticsearrch so same mapping need in elasticsearch

[magnusbaeck (Magnus Bäck)]

Yes, Logstash can store data in Elasticsearch. If you use the grok filter as described in the other thread you'll get your log entries stored in Elasticsearch with separate fields for the timestamp, log level, class name, and so on. No further action is necessary on the Elasticsearch side.