Logstash grok break E0802 into E and 0802

Elastic Stack Logstash
1

How do I break E0802 into E and 0802?

http://grokdebug.herokuapp.com/

image
image.png762×151 27.6 KB

E0802 05:01:29.979775 30003 logging.cc:121] stderr will be logged to this file.

image
image.png1189×78 2.56 KB

%{NOTSPACE:log_level} %{NOTSPACE:log_time} %{NOTSPACE:log_threadid} %{NOTSPACE:log_file}:%{NOTSPACE:log_line}] %{GREEDYDATA:log_msg}

image
image.png1185×80 9.04 KB

image
image.png440×865 5.75 KB

2

Use grok.

grok { match => { "log_level" => "(?<e>.)%{NUMBER:foo}" } }
3

Wait, what did you do to make everything an array of arrays? I would have expected that to get parsed as (in rubydebug terms)

"log_level" => "E0802"
"log_time" => "05:01:29.979775"

etc.