Parse key value pair only from the parenthesis


(Mohit Sakarkar) #1

Hi,

I am new in logstash, I have large file of tomcat application log and I need to parse only request and response which is available in key value pair form in square brackets, please see request and response below from the large log file:

REQUEST
09/09/2018 23:40:02:388 INFO eivrLogger Hashcode: 1487574513 method: EIVR_nedLookupAttributeRouting - dW20180909233811001D1165b306c76f - NEDLookupAttributeRoutingRequest Object : NedLookupAttributeRoutingRequest [applicationName=WESTEIVR, dasSessionId=dW20180909233811001D1165b306c76f, telephonyUID=dW20180909233811001D1165b306c76f, ani=1234556757, dnis=7895647, ced=null, language=ENG, vuiBusinessHierarchyElement=com.comcast.ned.common.types.BusinessHierarchyElement@736a30d2, enteredZipCode=25698, divisionHierarchyName=DIV_NORTHEAST, regionHierarchyName=REG_FREEDOM, marketHierarchyName=MKT_PHILADELPHIA_PA_AREA_1_PA, corpSysprinHiearchyName=849910002, accountNumber=849910002512345, accountType=RESIDENTIAL, trunkType=null, browserSessionId=, browserGrpName=DEFAULT_BROWSER_GROUP_NAME, browserHostName=, callFlowPoint=ROUTING_LOOKUP, keyValuePairs=KeyValuePairs [keyValueData=[KeyValueData [key=Module, value=Technical], KeyValueData [key=Type, value=HSI], KeyValueData [key=SubType, value=WirelessGateway], KeyValueData [key=Extension, value=], KeyValueData [key=Term, value=795158012345]]]]

RESPONSE
Final NEDLookupAttributeRoutingResponse Object: NedLookupAttributeRoutingResponse [extAttrRtgAction=TRANSFER, dialString=795158012345, setupString=null, terminationString=null, transferType=SIPREF_UUI, overrideReasonName=PRS_0_30_WIFI, callFlowBranchLabel=null, attributeRoutingServer=null, attributeRoutingUID=403237476, keyValuePairs=KeyValuePairs [keyValueData=[KeyValueData [key=NOT_NEWLOB_COS_OVERRIDE, value=TRUE], KeyValueData [key=PRS_0_30, value=TRUE], KeyValueData [key=ID, value=TRUE]]]]

Please suggest to parse both request and response as one record.

Thanks in advance.


(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.