日志模式的grok过滤器

Question

I have a log pattern which is this form.

field1|field2|field3|field4|field5| key1=value1 key2=value2 key3=value3

key value pair can some in any order. key2 may be earlier that key1.

I am able to parse the field1-field5. BUt not sure how to do it for key value pairs

%{GREEDYDATA:fieldValue1}\|%{GREEDYDATA:fieldValue2}\|%{GREEDYDATA:fieldValue3}\|%{GREEDYDATA:fieldValue4}\|%{GREEDYDATA:fieldValue5}\|

Can I create a map of key-value in grok and then send specific keys ??? Any advise ?

Answer 1

You can use kv filter to parse other part. Like:

grok {
    match => { "message" => "%{GREEDYDATA:fieldValue1}\|%{GREEDYDATA:fieldValue2}\|%{GREEDYDATA:fieldValue3}\|%{GREEDYDATA:fieldValue4}\|%{GREEDYDATA:fieldValue5}\| %{GREEDYDATA:keyValue}" }
 }
kv {
    source => "keyValue"
}