Obtaining Tags from Tags

Elastic Stack Logstash
1

Hello, I would like to Slipt a Tag in several parts. I mean, I have the Tag "Comment" = "[Module12] Statblablabla" I would like to divide it in other two Tags "Module" = Module12 and "Status" = Statblablabla. But with the Tag "Coment" preserved, I mean, at the end I would have 3 Tags.

This is the line in my patterns file:
COMMENT_MESSAGE (?m) [%{GREEDYDATA:Module}]\ %{GREEDYDATA:Status}

And I have tried

match => [
"Comment", "%{COMMENT_MESSAGE}"
]

What am I doing wrong? Because I only get Comment Tag, but not the other two.

2

You didn't format the pattern file line as code so things were probably stripped away, but the problem is probably the space before the opening square bracket. This works:

(?m)\[%{GREEDYDATA:Module}\] %{GREEDYDATA:Status}
3

I have tried it, but without success. I have the same problem, in Kibana I dont get these new Tags.

This is my grok filter

  grok {
                 patterns_dir => "/etc/logstash/patterns"

                 match => [
                         "message","%{MESSAGE_1}",
                         "message", "%{MESSAGE_2}",
                        "Comment","%{COMMENT_MESSAGE}"
                        ]
            }

And in my patterns file I have>

MESSAGE_1 (?m)%{DATE} \[%{LOGLEVEL:log_level}\] \<%{ERRORCODE:error_code}\> -> %{GREEDYDATA:Comment}
MESSAGE_2 (?m)%{DATE} \[%{APPNAME:app_name}\] \[%{LOGLEVEL:log_level}\] \<%{ERRORCODE:error_code}\> -> %{GREEDYDATA:Comment}
COMMENT_MESSAGE (?m)\[%{GREEDYDATA:Module}\] %{GREEDYDATA:ModuleComment}
4

See the solution offered in this thread from yesterday:

5

So the grok filters have to be separated, I have tried this but it doesn't work...

 grok {


         patterns_dir => "/etc/logstash/patterns"

         match => [
                 "message","%{MESSAGE_1}",
                 "message", "%{MESSAGE_2}"
                ]
        }


grok {

                 patterns_dir => "/etc/logstash/patterns"
         match => [
                 "Comment","%{COMMENT_MESSAGE}"
                ]

}