Logstash - Creating new field by taking first word from an other field

Elastic Stack Logstash
4

Add one more grok.

filter {
  if "WARNING" in [message] or "CRITICAL" in [message] {
    grok {
      match => {
        "message" => "\[%{HTTPDATE:FECHA}\] %{IP:DIR_IP} %{WORD:SERVIDOR} \"%{GREEDYDATA:MENSAJE}\""
      }
    }
   grok {
        match => {
            "MENSAJE" => [
                "^%{LOGLEVEL:SEVERITY}\:\s*"
            ]
        }
    }

  } else {
    drop {}
  }
}

Result:

{
      "message" => "[27/May/2022:19:04:50 +0200] 192.168.0.1 server1 \"WARNING: Este es un mensaje de aviso\"",
      "SERVIDOR" => "server1",
       "MENSAJE" => "WARNING: Este es un mensaje de aviso",
      "SEVERITY" => "WARNING",
         "FECHA" => "27/May/2022:19:04:50 +0200",
        "DIR_IP" => "192.168.0.1"
}
1 Like