Stashing Event Store logs

[dj0b (Dan)]

Good Afternoon,

I am wondering if anyone has any information on the best approach for stashing Event Store logs? Particularly, I am interested in the construction of the Message within the Event Store log, and how best to replace the tokens with the corresponding "EventProperties", there are too many variations for me to see a way to mutate the message tokens into the corresponding properties.

The Event Store log contains a line similar to the following:

{ "PID": "1423", "ThreadID": "1", "Date": "2019-07-11T05:04:02.321007Z", "Level": "Info", "Logger": "VNodeBuilder", "Message": "{description,-25} {writerCheckpoint} (0x{writerCheckpoint:X})", "EventProperties": { "description": "WRITER CHECKPOINT:", "writerCheckpoint": 986241149 } }

My Filebeat config is correctly generating the objects (PID, ThreadID, Date, EventPropertiesetc) but the message is constructed with the values as what seems to be tokens "Message": "{description,-25} {writerCheckpoint} (0x{writerCheckpoint:X})"

I am using the below on the Filebeat input

json.keys_under_root: true
json.add_error_key: true

I am relatively new to both Logstash and Event store, so I may be missing a key component here.

Thanks for your help
Dan

[Badger]

It's unclear what fields you want on the final document.

[dj0b (Dan)]

Hi Badger,

Field "Message" currently contains:

{description,-25} {writerCheckpoint} (0x{writerCheckpoint:X})

Ideally, I need to find a way to replace

{description,-25} with field EventProperties.description
{writerCheckpoint} and {writerCheckpoint:X} with EventProperties. writerCheckpoint

The issue I have is there are many more of these tokens and corresponding properties that have been collected as fields from the JSON data within the Event Store logs, reading over my question, maybe I should be asking Event Store how they intended for these logs to be read and the tokens populated?