Parse log with different lines in logstash

I am trying to parse following logs:
<0> 2019-11-08 16:26:03.420 [logsource="" logid="50"] SystemTrace TID:1 Tracer started.
<1> 2019-11-08 16:26:03.418 [logsource="" logid="50"] SystemTrace TID:1 Operations1.GetErrorCode| --> Start
<2> 2019-11-08 16:26:03.434 [logsource="" logid="40"] FunctionTrace TID:1 Operations2.Get| --> Start
<5> 2019-11-08 16:26:03.747 [logsource="" logid="30"] Information TID:1 Test Created08/11/2019 16:26:03
<7> 2019-11-08 16:26:04.012 [logsource="" logid="50"] SystemTrace TID:8 LoginPortal Logout Session has been expired

I wrote two Grok pattern, testing them individually and they working fine. However, when I combines the Grok patterns to parse the above log it does not map some of the data in correct column. Here is the Grok pattern:

(<%{INT:SerialNo}>\t%{TIMESTAMP_ISO8601:timestamp}\t%{IP:ipaddress}\t\[.*?=%{QUOTEDSTRING:logsource} .*?=%{QUOTEDSTRING:logid}\]\t%{WORD:Category}\t.*?:%{INT:TID}\t%{WORD:ControllerName}.%{WORD:function}[|] [-]+[>] %{WORD:Position}\s*%{GREEDYDATA:Duration})|(<%{INT:SerialNo}>\t%{TIMESTAMP_ISO8601:timestamp}\t%{IP:ipaddress}\t\[.*?=%{QUOTEDSTRING:logsource} .*?=%{QUOTEDSTRING:logid}\]\t%{WORD:Category}\t.*?:%{INT:TID}\t%{GREEDYDATA:message})

Kindly assist me.

Which data is in which fields and which fields do you want it to be in?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.