Windows log text file data is not parsing logstash

Can you please check and help:

Find the below Logs need to monitor:

Timestamp: 12/24/2019 5:42:04 AM

Message: Task timed out - SKKW is not responding in timely manner

Category: Error

Priority: -1

EventId: 1

Severity: Information

Title:

Machine: AIAWGS001

App Domain: /LM/W3RDS/64/ROOT/UXP.Services/IeeRaa/UMP.Services.IeeRaa.UserServices-301-132216577167216650

ProcessId: 15068

Process Name: c:\windows\system32\inetsrv\w3wp.exe

Thread Name:

Win32 ThreadId:19512

Extended Properties:

WebSession - BC720.BC720@Q7T0+cK7Bf4UOzfKe9F8HUv6yC4=


Find the below logstash file trying:
input {
file {
path => [ "/D:/LT_Logs_Montoring/Logsfile/UXP.Services.OneView.UserServices.2019-12-23.23_v1.txt" ]
start_position => "beginning"
codec => multiline {
pattern => "+"
negate => true
what => previous
sincedb_path => "/dev/null"
}
}
}

filter {
if "multiline" not in [tags] {
drop {}
}

grok {

match => {"message" => "Timestamp : %{NOTSPACE:date}\r\nMessage : %{DATA:message}\r\nCategory : %{NOTSPACE:file}"}

}

}

output {
elasticsearch {
hosts => ["http://localhost:9200"]
index => "onetestlogfile"
}
}

using above setting in conf file.

Error: " java illegal exception ,Dont no how to handle i " Please find the attached screen shot

image

Please do not post pictures of text, just post the text. Also, please format your post using markdown to format your posts if you expect folks to read them. Specifically code quoting .

Your configurations should

 look like
 this

in the preview pane on the right of the editing pane.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.