Parsing log using grok format


I am new to logstash and trying to parse below log using grok format.

2015-11-27 11:51:28,103 INFO @

So far i have build first three field using

which gives me

timestamp 2015-11-27·11:51:28,103
loglevel INFO

however, i want to parse other field like

user anonymous
session 20B27B5F10A828221F1C3D8B578267E9
action view_collection
collectionId xxxxx

i tried several regular expression command at to achieve above but none working with grok.

Any help greatly appreciated


The content after the '@' sign seems to be a property list. Catch all this into a single variable using grok and then use the KV filter to parse this.

1 Like