Same pattern multiple times in a single logmessage

Elastic Stack Logstash
1

One of the log messages is like this:

2016-07-20 09:01:39,708 28152772 INFO Received message key1=value1 key2=value2 key3=value3
Msg 1: word1 rslt=0x00 try=1
Msg 2: word2 rslt=0x01 try=4
Msg 3: word2 rslt=0x02 try=8
Msg 4: word1 rslt=0x03 try=9

Note:

  • there can be any number of line of type
    Msg 'num': 'word' rslt='hexadecimal' try='num'

I want single output with multiple json objects, like this:

{

{
"msg_number":1,
"msg_name": word1
"rslt":0x00
"try":1
}

{
"msg_number" : 2,
"msg_name": word2
"rslt":0x01
"try":4
},

{
"msg_number" : 3,
"msg_name" : word2
"rslt" : 0x02
"try" : 8
},

{
"msg_number" : 4,
"msg_name" : word1
"rslt" : 0x03
"try" : 9
}
}

Any help would be appreciated... :slight_smile:

2

IMO,

I think your going to have to use the ruby filter, as you have variable amounts of fields

https://www.elastic.co/guide/en/logstash/current/plugins-filters-ruby.html

3

Well, I was trying not to use ruby filter, but it seems that is the only solution.
Thanks :slight_smile: