# Video log processing logstash

**URL:** <https://discuss.elastic.co/t/video-log-processing-logstash/80985>\
**Category:** Logstash\
**Created:** [April 3, 2017, 10:28am UTC](https://discuss.elastic.co/t/video-log-processing-logstash/80985 "2017-04-03T10:28:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rach](https://avatars.discourse-cdn.com/v4/letter/r/ecb155/32.png) [@rach](https://discuss.elastic.co/u/rach)\
**Post date:** [April 3, 2017, 10:28am UTC](https://discuss.elastic.co/t/video-log-processing-logstash/80985/1 "2017-04-03T10:28:56Z")

</div>

hi 🙂  
can you please help me process the following video log?  
I will have multiple dynamic fields (which not appear all the time), and this is my log:

02/04 10:07:59.216,DEBUG,10024,JDM,"Received: FR\_JOB\_RESULT msg, from service type: recognition, to service type: manager, class: Fre from 127.0.0.1:29923(recognition) to 127.0.0.1:37469(manager) for FR job (id #32352 session #21303) ,result type: Success ihd=224, fics=[3], current td=-1, eest=-1.0, proceime=604, result:[], QRs:[]",com.1.jdm.Jdm(495),Jdm

thank you!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 3, 2017, 11:07am UTC](https://discuss.elastic.co/t/video-log-processing-logstash/80985/2 "2017-04-03T11:07:02Z")

</div>

It's a bit hard to help when you're not telling us which parts are dynamic, but I'm guessing everything up to and including "type: Success" is more or less static. Use a grok filter to extract fields from there and put the rest of the string in a field that you process with a kv filter.

---

<div class="post-metadata">

**Author:** ![rach](https://avatars.discourse-cdn.com/v4/letter/r/ecb155/32.png) [@rach](https://discuss.elastic.co/u/rach)\
**Post date:** [April 3, 2017, 11:52am UTC](https://discuss.elastic.co/t/video-log-processing-logstash/80985/3 "2017-04-03T11:52:08Z")

</div>

thanks for the answer.  
my problem is that i don't know how to address the " (beginning in the Received and ending with []) so that it will be part of my message...  
i tried this and it didn't work...:  
input {  
beats {  
port =\> "5043"  
}  
}

filter {  
grok {  
match =\> { "message" =\>"%{MONTHNUM:month}/%{MONTHDAY:day} %{TIME:time},%{WORD:level},%{WORD:proccess\_id},%{WORD:component\_type},%{GREEDYDATA:msg}" }  
}  
kv {  
source =\> "msg"  
value\_split =\> ":"  
}  
mutate {  
gsub =\> [  
"msg", "[\"]", " "  
]  
}  
}

output {  
elasticsearch {  
hosts =\> "localhost:9200"  
index =\> "a-%{+YYYY.MM.dd}"  
document\_type =\> "try"  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 1, 2017, 11:52am UTC](https://discuss.elastic.co/t/video-log-processing-logstash/80985/4 "2017-05-01T11:52:18Z")

</div>

Closed on May 1, 2017, 11:52am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.