Well, your log line is pretty simple, you have a plain text part and a kv part, you can use a combination of the dissect
filter and the kv
filter to parse it.
Considering that the two - -
in your message are fields that could be present or not, you can use the following dissect
to parse this message.
dissect {
mapping => {
"message" => "<%{}>%{} %{timestamp} %{hostname} %{appname} %{thread} %{extra1} %{extra2} %{kvmsg}"
}
}
The empty %{}
will not store any data, the named ones will store the value in that position in a field with the name specified.
This filter will give you the following fields:
{
"extra1": "-",
"message": "<14>1 2016-12-25T09:03:52.754646-06:00 xxxxxhost1 antivirus 2496 - - alertname=\"Virus Found\" computername=\"xxxxxxpc42\" computerip=\"123.45.678.910\" severity=\"1\"",
"kvmsg": "alertname=\"Virus Found\" computername=\"xxxxxxpc42\" computerip=\"123.45.678.910\" severity=\"1\"",
"appname": "antivirus",
"host": "weiss",
"hostname": "xxxxxhost1",
"@version": "1",
"@timestamp": "2021-08-28T22:49:15.783Z",
"extra2": "-",
"timestamp": "2016-12-25T09:03:52.754646-06:00",
"thread": "2496"
}
The fields @version
, @timestamp
and host
are created by logstash.
To parse the message in the kvmsg
field you just need to use the kv
filter.
kv {
source => "kvmsg"
}
So, in the end your message will have the following fields.
{
"kvmsg": "alertname=\"Virus Found\" computername=\"xxxxxxpc42\" computerip=\"123.45.678.910\" severity=\"1\"",
"alertname": "Virus Found",
"timestamp": "2016-12-25T09:03:52.754646-06:00",
"host": "weiss",
"message": "<14>1 2016-12-25T09:03:52.754646-06:00 xxxxxhost1 antivirus 2496 - - alertname=\"Virus Found\" computername=\"xxxxxxpc42\" computerip=\"123.45.678.910\" severity=\"1\"",
"thread": "2496",
"computername": "xxxxxxpc42",
"@timestamp": "2021-08-28T22:52:07.009Z",
"@version": "1",
"computerip": "123.45.678.910",
"severity": "1",
"extra2": "-",
"appname": "antivirus",
"extra1": "-",
"hostname": "xxxxxhost1"
}
If you do not want any of those fields in your final message, you can use the mutate
filter to remove it.
mutate {
remove_field => [ "fieldname1", "fieldnameN" ]
}
To write this message in a file you just use the file
output filter.
output {
file {
path => "/path/to/the/output/file.json"
}
}