Parsing syslog param1=value1 param2="value2"

Elastic Stack Logstash
1

Trying to learn GROK by using the GROK debugger tool in Kibana.

Data is stuctured like this:

param1=value1 param2="value 2" param4=param4
param1=value1 param2="value 2" param3=param3 param4=param4

Questions are:

  1. Will I be able to write a filter/GROK that takes care of a dynamic structure (sometimes paramX is missing)?

  2. Do I need to define the structure? Can't I just make [foreach paramX, store the key paramX with a value of valueX]?

The only thing that's complicating parsing is that sometimes valueX contains one or more spaces, but then its surrounded by "

Thank you very much for your support!

2

Why not use a kv filter?

3

Thank you for your reply. Please tell me a little more... Is that a plugin? Why would threre be a benefit?

4

Thank you very much for pointing me in the right direction :slight_smile:

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.