Here is my one log segment which file beat picked.
2019-10-23 09:53:43.2218 - [yyy] [EF] Opened connection at 10/23/2019 9:53:43 AM +05:30
2019-10-23 09:53:43.2218 - [yyy] [EF]
*SELECT Count()
FROM INFORMATION_SCHEMA
2019-10-23 09:53:43.2218 - [yyy] [EF]
2019-10-23 09:53:43.2257 - [yyy] [EF] -- Executing at 10/23/2019 9:53:43 AM +05:30
2019-10-23 09:53:43.3504 - [yyy] [EF] -- Completed in 123 ms with result: 60
2019-10-23 09:53:43.3504 - [yyy] [EF]
2019-10-23 09:53:43.3504 - [yyy] [EF] Closed connection at 10/23/2019 9:53:43 AM +05:30
it piked from "[timestamp] [x ] [y] Open Connection" to next "[timestamp] [y] Open Connection"
I want to extract the above bold lines(sql query and completed time in ms ) using grok pattern in logstash. is it possible to do?
This this the way I'm try to do this. But it is not valied
(?m)%{TIMESTAMP_ISO8601:timestamp} - \[%{NOTSPACE:orgCode}\] \[%{NOTSPACE:framework}\] %{GREEDYDATA:startingMessage}%{TIMESTAMP_ISO8601} - \[%{NOTSPACE}\] \[%{NOTSPACE}\] %{GREEDYDATA:message} %{TIMESTAMP_ISO8601}