I have the following message
2021-01-04T00:04:00.8033345+00:00 0HM5E5E28610F:00000001 [INF] MyMessage
What I'm trying to do is to extract each of those fields into a separate column for my index.
This is what I have been using to parse the message in my pipeline
filter {
mutate {
strip => "message"
}
grok {
match => { "message" => "%{DATA:logdate} %{DATA:thread_id} \[%{LOGLEVEL:log.level}\] %{GREEDYDATA:message}" }
}
date {
match => [ "logdate", "yyyy-MM-dd HH:mm:ss.SSSSSSSZZ" ]
target => "@timestamp"
}
}
At the end, I'm getting parse errors and my message ends up in Elasticsearch by sending the whole message as a column in my index. The idea is to break the 4 data I have in each line into different columns. Not only GrokParseError I receive, but also issues while converting the date.
Any idea on how to solve it?