Current Config is
filter {
grok {
patterns_dir => ["./patterns"]
match => { "message" => "[%{TIMESTAMP_ISO8601:timestamp} #%{POSINT:pid}] *%{RUBY_LOGLEVEL:loglevel} -- +%{DATA:progname}: %{GREEDYDATA:message}" }
}
}
Here kibana Message is showing method. I want to make those to separate. Could you please help me to do that
and I have 2 logs format. I want to run it from a single conf file.
%{TIMESTAMP_ISO8601:mongodb.log.timestamp} %{WORD:mongodb.log.severity} %{WORD:mongodb.log.component} %{GREEDYDATA:mongodb.log.context} %{GREEDYDATA:mongodb.log.message}