Metatrader: How Parse Such Logs?

Hi,

0	23:35:01.102	Monitor	connections: 354  free memory: 3124552 kb  cpu: 3%  net: 0 Kbyte/s sockets: 513 threads: 71 handles: 1423
0	23:35:01.102	Monitor	max. memory block: 2064156 kb process cpu: 0%  net in: 0 Kbyte/s  net out: 0 Kbyte/s
2	23:35:06.914	14.122.168.78	'2000174629': login (1090, client, dc: 0, cid: 56a3e17fcb6e43473892d93c6993a39e, ping: 186 ms)
4	23:35:07.064	132.232.36.91	'2000179070': account disabled by group [ForexCN-USD]
2	23:35:09.537	103.100.29.64	'2000083124': login (1090, client, dc: 0, cid: 74e82115c1a3ae5b46f0fb2ba59b130b, ping: 75 ms)
2	23:35:11.253	103.100.29.64	'2000085413': login (1090, client, dc: 0, cid: 74e82115c1a3ae5b46f0fb2ba59b130b, ping: 50 ms)
2	23:35:16.097	14.122.168.78	'2000151289': login (1090, client, dc: 0, cid: 56a3e17fcb6e43473892d93c6993a39e, ping: 175 ms)
2	23:35:28.441	123.165.255.184	'2000178502': login (1090, client, dc: 2, cid: 8870175c23a7336489d3b905443cb057, ping: 150 ms)
2	23:35:33.888	192.229.22.167	'366': login (1134, datafeed, dc: 0)
2	23:35:39.552	103.100.29.64	'2000083124': login (1090, client, dc: 0, cid: 74e82115c1a3ae5b46f0fb2ba59b130b, ping: 75 ms)
2	23:35:41.198	103.100.29.64	'2000085413': login (1090, client, dc: 0, cid: 74e82115c1a3ae5b46f0fb2ba59b130b, ping: 45 ms)
2	23:35:41.498	138.44.64.114	'30017119': login (1090, client, dc: 0, cid: 9fd9ad16af1b0862eee5ae1a4caabc3a, ping: 25 ms)
2	23:35:42.990	168.1.122.171	'9': login (1090, dc, dc: 0)
2	23:35:44.439	77.224.88.206	'30024299': login (1090, client, dc: 2, cid: 6c73b6c38fa11fe3c95023a90f97dd21, ping: 250 ms)
0	23:35:46.563	FX LITE	terminal connections: 7  web/mobile connections: 0  allocated memory: 3350 kb
2	23:35:49.523	168.1.62.21	'28': login (1090, dc, dc: 0)
2	23:35:52.989	47.106.76.208	'2000176402': login (1090, client, dc: 0, cid: cd78552338ea525a01966b360aeae5ef, ping: 125 ms, investor)
0	23:36:01.105	Monitor	connections: 358  free memory: 3123388 kb  cpu: 3%  net: 0 Kbyte/s sockets: 513 threads: 71 handles: 1348

I tried many patterns, No Success :worried:, anyhelp will be appericated.

I would take off the first two fields using then dissect, then use grok with an array of patterns to match each of the message types that you care about.

dissect { mapping => { "message" => "%{someNumber} %{someIP} %{[@metadata][restOfLine]}" }
grok {
    match => {
        "[@metadata][restOfLine]" => [
            "^%{IPV4:anotherIP} '%{NUMBER:anotherNumber}': login ...",
            "^Monitor connections: %{NUMBER:connections}  free memory: %{NUMBER:freeKB}  ..."
        ]
    }
}

Thanks for Quick Response, But Second Value is Time with Milli Sec not IP

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.