Personal Fields in Grok Debugger

[Eric_Santos]

Hi All,

I'm early on ELK. I have an log for one application in my Apache and i need to get values of this this Fields

DataTime:
NumConnections:
NumBusyConnections:
NunIdleConnections:

In Kibana, i have this information in field message:

INFO [20 jul 2018 09:25:21] PoolJDBC - [Pool Properties] NumConnections: 50 | NumBusyConnections: 2 | NumIdleConnections: 48

How i can get this information on Grok Debbuger?

Thanks
Eric

[kskubala (Krzysztof)]

How are you sending logs to ElasticSearch ?

[Eric_Santos]

Hi

in this case, i'm use filebeat 6.3.1

[kskubala (Krzysztof)]

I more likely asked whether you use Logstash or straight to ES. You can parse message in logstash in which you extract fields you want.

[Eric_Santos]

For this case, i have a filebeat in my application server (Windows 2012) with this configurations on filebeat.yml

During this weekend i tried to read this information using a Grok Debugger online (https://grokdebug.herokuapp.com/).

Below are my best result :

%{WORD:T1} %{WORD:T2} %{WORD:T3} %{TIME:H1}\S %{WORD:T4}\s\S\s\S%{WORD:T5}\s%{WORD:T6}\S %{WORD:NunnConn}\S\s%{NUMBER:NumConnections}\s\S\s%{WORD:NumBusy}\S\s%{NUMBER:NumBusyConnections}\s\S\s%{WORD:NumIdle}\S\s%{NUMBER:NumIdleConnections}

message: INFO [19 jul 2018 22:23:48] PoolJDBC - [Pool Properties] NumConnections: 50 | NumBusyConnections: 1 | NumIdleConnections: 49

I see this result in my Kibana (with default configuration):

Thank you for your support.

Eric