Want to extract username from log and add it into TAG


(Nasir Ahmad) #1

Hi,

I have a log with bellow pattern:

2018-09-05 11:50:56,152 - INFO - 103.8.115.242 - username1 - com.example.test.service.testService - [ajp-nio-8009-exec-9] - /testServiceCall/default/testPage [page=default, component=testComponent, service=testService, method=testMethod] - @OcService.refreshTree

2018-09-05 11:50:56,152 - INFO - 103.8.115.242 - username2 - com.example.test.service.testService - [ajp-nio-8009-exec-9] - /testServiceCall/default/testPage [page=default, component=testComponent, service=testService, method=testMethod] - @OcService.refreshTree

I want to extract the username1 and username2 with the help of Grok and add the usernames into username TAG for each log.

Any help is appreciated on this topic.

Thanks,
Nasir


#2

Checkout the following link to find out what grok patterns are pre-available

and the following link to test your grok pattern

http://grokconstructor.appspot.com/do/match#result

Try out the following grok for your usecase

grok {
    match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} - %{WORD} - %{IP} - %{WORD:username} - %{GREEDYDATA:source}" }
}

(Nasir Ahmad) #3

Thank you @abhiroyg. This helped a lot. :slight_smile:


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.