Rsyslog to logstash as json -> extract pattern from message

Elastic Stack Logstash
1

Hello all,

I am sending rsyslog data to logstash via udp. Here is the logstash configuration:

input {
udp {
port => 15044
codec => "json"
type => "rsyslog"
}
}
filter {
if [srvtype] == "test" {
json {
source => ""
remove_field => ["facility"]
}
mutate {
add_field => {
"test" => ""
}
rename => {
"[message]" => "[errormessage]"
}
}
}
}

The message is something like:

text text text (TEXT1.TEXT2) [Thread 489] (Msg 1/1) XYZ2154: text...

the interesting part for me is TEXT1 and XYZ2154.
is there any way to take these strings and add them in a new field in the mutate ?

thank you

2

Hi,

Here's an example of how you might use the grok filter to extract the TEXT1 and XYZ2154 parts of your message:

filter {
  if [srvtype] == "test" {
    grok {
      match => { "message" => ".*\(%{WORD:TEXT1}\.%{WORD:TEXT2}\).*%{WORD:code}:.*" }
    }
    mutate {
      remove_field => ["facility"]
      rename => { "message" => "errormessage" }
    }
  }
}

Regards

3

Thank you for the reply.

is working fine !