Logstash and flexlm log

Elastic Stack Logstash
1

Hi everyone,

I am newbie at logstash and would like to parse a flexlm log file. The problem is the log is not easy to parse.

(lmgrd) FlexNet Licensing blabla TIMESTAMP 06/12/2015
09:25:48 (MLM) OUT: "MATLAB" USER2@MACH529
10:28:56 (MLM) IN: "MATLAB" USER2@MACH529

what's the best way to concatenate the Date (DD/MM/YYYY) with the time ?

i already used memorized filter, but it didn't let me concatenate these 2 fields.
"checkout_time" => "%{flexlm_ts} 09:25:48"

Thanks in advance for your help, and sorry for my bad english.

2

Hi @el_tunisiano38, can you post your current logstash filter configuration ?

Thanks

3

yes of course,

filter {

  if [type] == "flexlm" {

   if [message] =~ /TIMESTAMP/ {
        grok {
                match => [ "message", "%{GREEDYDATA:greedy_data} TIMESTAMP %{DATE:flexlm_ts}" ]
             }
    }

    else if [message] =~ /OUT/ {
        grok {
            match => [ "message", "%{DATA:checkout_time} \(%{DATA:vendor}\) OUT: \"%{DATA:feature_name}\" %{DATA:user_id}@%{DATA:client_machine}" ]
        }
            mutate { replace => ["checkout_time", "%{flexlm_ts} %{checkout_time}"] }
    }
         memorize {
             fields => ['flexlm_ts']
        }
   }
}
4

Hi @el_tunisiano38,

I found the problem, but I must first point out that logstash-filter-memorize is not an officially supported plugin (although I agree it does seem rather useful!)

When the filter runs, it has 2 jobs - it memorizes fields, and also injects memorized fields into the event. Since filters run in sequence, the memorized field had not yet been injected into the event when you tried to access it. Try this instead:

filter {

   if [message] =~ /TIMESTAMP/ {
        grok {
                match => [ "message", "%{GREEDYDATA:greedy_data} TIMESTAMP %{DATE:flexlm_ts}" ]
        }
    }

    memorize {
        fields => [ "flexlm_ts" ]
    }

    if [message] =~ /OUT/ {
        grok {
         match => [ "message", "%{DATA:checkout_time} \(%{DATA:vendor}\) OUT: \"%{DATA:feature_name}\" %{DATA:user_id}@%{DATA:client_machine}" ]
        }
        mutate { replace => ["checkout_time", "%{flexlm_ts} %{checkout_time}"] }
    }


}
5

Hi Phaedrus,

Thanks alot, it works this way. but i tried a third option which does'nt work also except yours). I Placed the memorize in the first if block.

Thanks again.