Writing GROK for tomcat logs

Elastic Stack Logstash
1

Am trying to parse Tomcat logs using GROK filter my logs has the below format
03/14/18 02:01:26 Event Created in BPPM: 512461 in 6ms

The last field 6ms field is average response time of the app which i want to have as INTEGER so that it can be aggregatable in KIBANA how to achieve this using GROK.

2

Quoting the grok filter documentation:

Optionally you can add a data type conversion to your grok pattern. By default all semantics are saved as strings. If you wish to convert a semantic’s data type, for example change a string to an integer then suffix it with the target data type. For example %{NUMBER:num:int} which converts the num semantic from a string to an integer. Currently the only supported conversions are int and float.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.