Logstash : Filter column values in a log

Elastic Stack Logstash
1

Hi , I am using Logstash to parse and filter the data. The input data looks something like this:

Nov 28 23:00:31   Phase 0 ended (4 seconds)
                        X Time    X/S    X/SK S/C
                           0.140 [  : 1]   0% TEXT
                           0.270 [  : 1]   0% TEXT
                           0.080 [  : 1]   0% TEXT
--------------------------------------------------------------------------------
               B/W            R/W      S/R               SF            V    P/W
              
               0               0      [: : 0]          7535996       text   text                                       
               0               3      [: : 0]          7535996       text   text 
               1235            2      [: : 0]          7535996       text   text 
			   out             0      [: : 0]          7535996       text   text
               0               0      [: : 0]          7535996       text   text 			 
-----------------------------------------------------------------------------------

I want to access R/W column values. Can anyone help me solving the problem ?

2

What is the data that you need from this? And how are you consuming this?

3

In the above sample log, there is a column R/W. I want the sum of R/w column.

4

And how is this data coming? Is it possible to filter out the remaining data from the file?

If you can filter it out, you can use dissect or kv to easily parse the data.

Regards,
Nachiket

5

Thank you for the response. It was quite helpful but it couldn't solve my problem. In my case it is unable to detect the pattern. This is how my dissect is :
dissect { mapping => { "message" => "%{B/W} %{R/W} %{S/R} %{SF} %{V} %{P/W}" } }

6

How did you filter out the data that was not needed? Please post the solution if you don't mind, it will probably help others in the future.

From the sample logs, it looks like there are multiple delimiters in your input data. The dissect pattern does not account for multiple consecutive delimiters. Try using the following kind of pattern. More information is available in the docs.

%{BW->} %{RW->} %{SR->} %{SF->} %{V->} %{P/W}
7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.