Parsing tabular data into canvas

Elastic Stack Logstash
#1

hi, how can i parse this output of command to push into into a table in Canvas :

prec:   rqstd,  stored, dropped, retried, rtsfail,rtrydrop, psretry,   acked,utlisatn,q length,Data Mbits/s,Phy Mbits/s, %air, %effcy  (v5)
  00:       0,       0,       0,       0,       0,       0,       0,       0,       0,     236,     0.00,       0.00,     0.0,    0.0
  01:       0,       0,       0,       -,       -,       0,       0,       0,       0,     236,     0.00,          -,       -,      -
  02:       0,       0,       0,       0,       0,       0,       0,       0,       0,     236,     0.00,       0.00,     0.0,    0.0
  03:       0,       0,       0,       -,       -,       0,       0,       0,       0,     236,     0.00,          -,       -,      -
  04:       8,       8,       0,       0,       0,       0,       0,       0,       0,     236,     0.00,       0.00,     0.0,    0.0
  05:       0,       0,       0,       -,       -,       0,       0,       0,       0,     236,     0.00,          -,       -,      -
  06:       0,       0,       0,       0,       0,       0,       0,       0,       0,     236,     0.00,       0.00,     0.0,    0.0
  07:       0,       0,       0,       -,       -,       0,       0,       0,       0,     236,     0.00,          -,       -,      -
  08:       0,       0,       0,       0,       0,       0,       0,       0,       0,     236,     0.00,       0.00,     0.0,    0.0
  09:       0,       0,       0,       -,       -,       0,       0,       0,       0,     236,     0.00,          -,       -,      -
  10:       0,       0,       0,       0,       0,       0,       0,       0,       0,     236,     0.00,       0.00,     0.0,    0.0
  11:       0,       0,       0,       -,       -,       0,       0,       0,       0,     236,     0.00,          -,       -,      -
  12:       0,       0,       0,       0,       0,       0,       0,       0,       0,     236,     0.00,       0.00,     0.0,    0.0
  13:       0,       0,       0,       -,       -,       0,       0,       0,       0,     236,     0.00,          -,       -,      -
  14:       0,       0,       0,     455,       0,       1,       0,     596,       0,     236,     0.01,       0.00,     0.5,    0.0
  15:     597,     597,       0,       -,       -,       0,       0,       0,       0,     236,     0.00,          -,       -,      -

any help please i need a grok pattern

#2

My initial thought was that there had to be a better filter to use, maybe dissect or csv, but then you would have to trim all the resulting fields. So go with grok...

 if [message] =~ /^prec:/ { drop {} }
 grok { match => { "message" => "\s*%{NUMBER:prec}:\s*(?<rqstd>([0-9]+|-)),\s*(?<stored>([0-9]+|-)),\s*(?<dropped>([0-9]+|-)),\s*(?<retried>([0-9]+|-)),\s*(?<rtsfail>([0-9]+|-)),\s*(?<rtrydrop>([0-9]+|-)),\s*(?<psretry>([0-9]+|-)),\s*(?<acked>([0-9]+|-)),\s*(?<utlisatn>([0-9]+|-)),\s*(?<qLength>([0-9]+|-)),\s*(?<dataRate>([.0-9]+|-)),\s*(?<physRate>([.0-9]+|-)),\s*(?<percentAir>([.0-9]+|-)),\s*(?<percentEffcy>([.0-9]+|-))" } }