Logstash Filter Pattern for Weblogic application logs

[dvkawa]

Hi ,

I am very new to ELK stack and I am trying to parse our weblogic application server logs using logstash and feed that to Elastic Search index and view in Kibana. Although I am able to get that indexed, I am looking for a way to capture few fields from the logs like log level (info, debug, error) and capture specific errors like connection time out etc. Can some one help with filter patterns for the same?

Thanks for any help.

[magnusbaeck (Magnus Bäck)]

For best results I suggest you edit your post and move it from Logstash-forwarder category to the Logstash category.

[dvkawa]

Thanks, updated the category, any help/suggestion is appreciated.Thanks

[magnusbaeck (Magnus Bäck)]

Without knowing exactly what the log looks like it's impossible to give specific help, but I can offer some general advice:

• Read and make sure you understand the examples in the documentation: https://www.elastic.co/guide/en/logstash/current/config-examples.html
• Write a grok filter to extract fields from the event text. If you're not very familiar with regular expressions http://grokconstructor.appspot.com/ can be of great help.
• Use a date filter to parse the extracted timestamp into the @timestamp field.

[dvkawa]

Many Thanks.
Log Snippet's screenshot attached.

[Gokhan_Sahin (Gökhan Şahin)]

Hi

You can examine,

http://grokconstructor.appspot.com/do/match#result