# Stashing Event Store logs

**URL:** <https://discuss.elastic.co/t/stashing-event-store-logs/207149>\
**Category:** Logstash\
**Created:** [November 8, 2019, 4:49pm UTC](https://discuss.elastic.co/t/stashing-event-store-logs/207149 "2019-11-08T16:49:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dj0b](https://avatars.discourse-cdn.com/v4/letter/d/48db29/32.png) [@dj0b](https://discuss.elastic.co/u/dj0b)\
**Post date:** [November 8, 2019, 4:49pm UTC](https://discuss.elastic.co/t/stashing-event-store-logs/207149/1 "2019-11-08T16:49:25Z")

</div>

Good Afternoon,

I am wondering if anyone has any information on the best approach for stashing Event Store logs? Particularly, I am interested in the construction of the Message within the Event Store log, and how best to replace the tokens with the corresponding "EventProperties", there are too many variations for me to see a way to mutate the message tokens into the corresponding properties.

The Event Store log contains a line similar to the following:

**{ "PID": "1423", "ThreadID": "1", "Date": "2019-07-11T05:04:02.321007Z", "Level": "Info", "Logger": "VNodeBuilder", "Message": "{description,-25} {writerCheckpoint} (0x{writerCheckpoint:X})", "EventProperties": { "description": "WRITER CHECKPOINT:", "writerCheckpoint": 986241149 } }**

My Filebeat config is correctly generating the objects **(PID, ThreadID, Date, EventPropertiesetc)** but the message is constructed with the values as what seems to be tokens **"Message": "{description,-25} {writerCheckpoint} (0x{writerCheckpoint:X})"**

I am using the below on the Filebeat input

json.keys\_under\_root: true  
json.add\_error\_key: true

I am relatively new to both Logstash and Event store, so I may be missing a key component here.

Thanks for your help  
Dan

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 8, 2019, 4:53pm UTC](https://discuss.elastic.co/t/stashing-event-store-logs/207149/2 "2019-11-08T16:53:13Z")

</div>

It's unclear what fields you want on the final document.

---

<div class="post-metadata">

**Author:** ![dj0b](https://avatars.discourse-cdn.com/v4/letter/d/48db29/32.png) [@dj0b](https://discuss.elastic.co/u/dj0b)\
**Post date:** [November 8, 2019, 5:05pm UTC](https://discuss.elastic.co/t/stashing-event-store-logs/207149/3 "2019-11-08T17:05:30Z")

</div>

Hi Badger,

Field "Message" currently contains:

{description,-25} {writerCheckpoint} (0x{writerCheckpoint:X})

Ideally, I need to find a way to replace

**{description,-25}** with field EventProperties.description  
**{writerCheckpoint} and {writerCheckpoint:X}** with EventProperties. writerCheckpoint

The issue I have is there are many more of these tokens and corresponding properties that have been collected as fields from the JSON data within the Event Store logs, reading over my question, maybe I should be asking Event Store how they intended for these logs to be read and the tokens populated?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 6, 2019, 5:05pm UTC](https://discuss.elastic.co/t/stashing-event-store-logs/207149/4 "2019-12-06T17:05:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.