非HTTP日志的ELK堆栈

Question

I used ELK for nginx log. It worked awesome. Is it OK to use ELK for non http log?? I have a memory log like below

• 10/24/16 04:10:01 2434 2559 66.81%
• 10/24/16 04:11:01 2436 2565 66.97%
• 10/24/16 04:12:01 2437 2566 66.00%

I used following match

 grok {
    match => 
  { "message" => "%{DATE:TIME} %{NUMBER:FREE} %{NUMBER:TOTALFREE} %{NUMBER:free_percent}%" }
  }
  date {
   match=> ["timestamp", "dd/MM/yyyy HH:mm:ss"]
  }

I got error ] stopping pipeline {:id=>"main"}.

I thought that time stamp is problem, so I removed timestamp, but still same issue

Answer 1

You forgot a closing curly bracket. Also your grokstring is probably not going to work. And your datestring is wrong, because the date is in US format.

grok {
  match => { "message" => "%{DATESTAMP:TIME} %{NUMBER:FREE} %{NUMBER:TOTALFREE} %{NUMBER:free_percent}%" }
}
date {
  match=> ["timestamp", "MM/dd/yyyy HH:mm:ss"]
}