Separating request URI path and query in logstash

(Khar) #1


I'm new with Logstash so forgive me for this basic question. I'm trying to create a GROK filter to parse the following log lines.

GET /rest/api/latest/user/search?username=xxxxxx&etag=331231 HTTP/1.1
GET /status HTTP/1.1

I'm trying to break string /rest/api/latest/user/search?username=1565349 where string after '?' is optional.

Here is the best I can do which match the first string but not on the second

grok {
    match => {"message" => "%{WORD:method} %{NOTSPACE:req_url}\?%{NOTSPACE:req_param} %{NOTSPACE:protocol}

Also, how to filter out "&etag=......." part from the logstash?

Any help is greatly appreciated.

(Khar) #2

Seems I found a solution.

Use KV filter to break down req_url.

grok {
    match => {"message" => "%{WORD:method} %{NOTSPACE:req_url} %{NOTSPACE:protocol}
  kv {
    source => "req_url"
    field_split => "?"

(system) closed #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.