Logstasg KV


(levi) #1

Hi All, i am new to logstash kv , i am tring to parse message that look like
{"HOSTNAME":"XXX","level":"INFO","logger_name":"elkUaLog","serviceName":"services-log","profile":"localdev","eurekaInstanceId":"services-log:2fe14fcfac1ad6581d7dc967b10463aa","message":"user-activity","eventName":"user-activity","eventType":"change","elementType":"input","inputType":"checkbox","fieldName":"deal.treatmentLead.cb163d89dbe-d6e7-4684-b9f1-37d2ef73380f","value":true,"timestamp":"1/15/2018, 1:25:06 PM","timeSinceStarted":"4.0 Sec","browser":"Chrome 63"}

i wrote filter

kv {
{ field_split => ",?"},
{ source => "message" },
{ value_split => ":" }

}

but i am getting error
can any one help ?


(Krunal Kalaria) #2

hi @neo_levi,

I think you should try CSV filter plugin its working properly

csv
{


(Krunal Kalaria) #3

csv
{


(Krunal Kalaria) #4

csv
{
separator => ","
}
sorry for above message its take automatically entered


(Krunal Kalaria) #5

Otherwise you can take
json
{
source => "message"
}


(levi) #6

Tnx Krunal, the json filter works


(Krunal Kalaria) #7

:slightly_smiling_face::blush:


(system) #8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.