While importing php errors log file in logstash not getting fields seperated from message in elastisearch

This is my php error log file

[20-Sep-2018 00:01:00 America/Los_Angeles] Uncaught PHP Exception LogicException: "The controller must return a response (null given). Did you forget to add a return statement somewhere in your controller?" at /mnt/www/html/shoppingstore/docroot/vendor/symfony/http-kernel/HttpKernel.php line 171 request_id="v-ee827c28-bca2-11e8-80cc-22000a1e2cfa"

This is my logstash confg file
""""""
input {
file {
path => "/home/Desktop/logfiles/php-errors.log"
start_position => "beginning"
sincedb_path => "/dev/null"
}
}
filter {
grok {
match => { "message" => "[%{MONTHDAY:day}-%{MONTH:month}-%{YEAR:year} %{TIME:time} %{WORD:zone}/%{WORD:country}] PHP %{DATA:level}: %{GREEDYDATA:error}" }
}

}

output {
elasticsearch {
hosts => "localhost:9200"
manage_template => false
index => "phperrorlog-%{+YYYY.MM.dd}"
document_type => "phperrorlog"
}
stdout { codec => rubydebug }
}
""""""

Output Response:
""
{

_index: "phperrorlog-2019.01.21",

_type: "phperrorlog",

_id: "yOWzb2gBmOi9Cy9CHuGo",

_score: 1,

_source: {
message: "[20-Sep-2018 00:01:00 America/Los_Angeles] Uncaught PHP Exception LogicException: "The controller must return a response (null given). Did you forget to add a return statement somewhere in your controller?" at /mnt/www/html/shoppingstore/docroot/vendor/symfony/http-kernel/HttpKernel.php line 171 request_id="v-ee827c28-bca2-11e8-80cc-22000a1e2cfa"",

@timestamp: "2019-01-21T09:17:15.558Z",

host: "p1",

tags: [
"_grokparsefailure"],

@version: "1",

path: "/home/Desktop/logfiles/php-errors.log"}

},
""""
I need values in that message separately like DATA, GREEDYDATA, TIME
Please help someone.

This is what you need...

input {
  generator {
    lines => [
      '[20-Sep-2018 00:01:00 America/Los_Angeles] Uncaught PHP Exception LogicException: "The controller must return a response (null given). Did you forget to add a return statement somewhere in your controller?" at /mnt/www/html/shoppingstore/docroot/vendor/symfony/http-kernel/HttpKernel.php line 171 request_id="v-ee827c28-bca2-11e8-80cc-22000a1e2cfa"'
    ]
    count => 1
  }
}

filter {
  grok {
    pattern_definitions => { "DATESTAMP_PHP" => "%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME} %{WORD}\/%{WORD}" }
    match => {
      "message" => [
        '\[%{DATESTAMP_PHP:timestamp}\] %{GREEDYDATA:msg}'
      ]
    }
    break_on_match => true
  }
}

output {
  stdout {
    codec => rubydebug
  }
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.