Logstash filter customize

Elastic Stack Logstash
1

my data type:

[INFO ] status => FAIL | client : [MTB] | cell : [1746710009] | message_delivery_time : [2017-08-07 09:46:27,807] | operator: [GP]
[INFO ] status => SENT | client : [IPDC] | cell : [1746710009] | message_delivery_time : [2017-08-07 09:46:27,807] | operator: [ROBI]

I need discovery available field
Host:
status:
client:
operator:
message_delivery_time:

how can I write logstash filter?
Please anybody help me
thanks

2

You have two options:

  • Use a grok filter to extract all the fields you're interested in. If you don't know regular expressions you can get help from the grok constructor web site.
  • Use a grok filter to separate "[INFO] status => fail" from the rest of the string, which is instead passed to a kv filter.

The latter is more flexible and tolerant against changes in the log message.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.