Logstash not parsing metadata from logfile

Hi,
I am very new to ELK Stack, I have a requirement to parse specific metadata from a log entry,
Here is a sample log entry,

[ERROR] [2021-01-04 14:56:41,566] [http-nio-8080-exec-4] [com.blocks.bear.server.exception.ExceptionHelper.handleServerExceptions(ExceptionHelper.java:63)] - {
  "method": "getSection",
  "userId": "31369",
  "jobId": "A1706",
  "stacktrace": "javax.servlet.http.HttpServlet.service(HttpServlet.java:660): DfServiceException while logging into Docs
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
	at java.lang.reflect.Method.invoke(Unknown Source)
	at org.apache.soap.server.RPCRouter.invoke(RPCRouter.java:146)
	"
}

My requirement is to get below mentioned fields as individual entries,

 method: getSection
 userId: 31369
 jobId: A1706
 stacktrace: javax.servlet.http.HttpServlet.service(HttpServlet.java:660): DfServiceException while logging into Docs
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)

Here is my logstash.conf file specifications 

input { 
  file {
    type => "java"
    path => "C:/ELK/test_logs.log"
    codec => multiline {
      pattern => "^%{TIMESTAMP_ISO8601} "
      negate => "true"
      what => "previous"
	}
  }
}
filter{
  grok {
    match => { "message" => "%{TIMESTAMP_ISO8601:date}%{GREEDYDATA:misc}{\n  (?m)%{GREEDYDATA:metadata}\n  (?m)%{GREEDYDATA:stacktrace}"}
  }
}
output {

  stdout {
    codec => rubydebug
  }
  
  elasticsearch {
    hosts => [ "localhost:9200" ]
  }
}

While I try to run the logstash and update the log file,
Logstash doesn't update the new entry until I stop it and before shutting down, it processes that entry but gives a grokparsefailure.

Any help would be highly appreciated.

Thanks

I would parse each line with a separate pattern

grok {
    break_on_match => false
    match => {
        "message => [
            "method: (?<method>[^\n]*)",
            "userId: (?<userId>[^\n]*)",
            "jobId: (?<jobId>[^\n]*)",
            ...
        ]
    }
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.