Using grok to extract android log data

Elastic Stack Logstash
1

Hi all, I'm a new user in ELK and logstash, and I'm trying to extract the following log with grok but without success for now.

This is my log:
08-14 10:22:50.863 1419 1419 D GpsNetInitiatedHandler: location enabled :false

and I wish to extract this like that:

  • timestamp: 08-14 10:22:50.863
  • not important 1: 1419
  • not important 2: 1419
  • log-level: D
  • message: GpsNetInitiatedHandler: location enabled :false

Thank you!

2

I would use dissect for that

    dissect { mapping => { "message" => "%{[@metadata][timestamp]} %{+[@metadata][timestamp]} %{} %{} %{loglevel} %{msg}" } }
    date { match => [ "[@metadata][timestamp]", "MM-dd HH:mm:ss.SSS" ] }

Since your timestamp does not contain a year logstash will guess which year it should use and you will almost certainly dislike the results sometimes.