Parsing custom Tomcat access log

Elastic Stack Logstash
1

Hi,

I have the following log line from tomcat access log:

192.123.120.11 (192.33.211.131) - USER123 [23/Mar/2015:00:00:12 +0000] GET /rest/url/v1/state?appStateOnly=true HTTP/1.1 200 111 7 rest.api.package:443

192.123.120.12 (192.33.211.131) - USER124 [23/Mar/2015:00:00:13 +0000] GET /rest/ping HTTP/1.1 200 23 177 download.package.com:443

192.123.120.12 (192.33.211.131) - USER003 [23/Mar/2015:00:00:14 +0000] GET /rest/url/v1/state?appStateOnly=true HTTP/1.1 200 111 6 rest.api.package:443

I've tried different examples out in the internet, is there a simple way to parse the above values?
I run Logstash v. 2.3.

Need a bit of help getting past this issue. Thanks!

2

Providing some examples of what you have tried may be useful for others to help you.

3

I was going to handle those string as csv-file, separating it on the whitespaces. It still looks for the best parsing example to me.

4

Apart the solution mentioned above, I found http://grokdebug.herokuapp.com and http://grokconstructor.appspot.com, which is easy to develop the regex pattern