Using grok to extract android log data

[Alisa_Faingold]

Hi all, I'm a new user in ELK and logstash, and I'm trying to extract the following log with grok but without success for now.

This is my log:
08-14 10:22:50.863 1419 1419 D GpsNetInitiatedHandler: location enabled :false

and I wish to extract this like that:

• timestamp: 08-14 10:22:50.863
• not important 1: 1419
• not important 2: 1419
• log-level: D
• message: GpsNetInitiatedHandler: location enabled :false

Thank you!

[Badger]

I would use dissect for that

    dissect { mapping => { "message" => "%{[@metadata][timestamp]} %{+[@metadata][timestamp]} %{} %{} %{loglevel} %{msg}" } }
    date { match => [ "[@metadata][timestamp]", "MM-dd HH:mm:ss.SSS" ] }

Since your timestamp does not contain a year logstash will guess which year it should use and you will almost certainly dislike the results sometimes.