用于自定义日志的Logstash筛选器Grok

Question

I'm using Logstash for the first time and I'm trying to map my logs with a grok filter, putting them on an ElasticSearch and visualizing with Kibana .

This is my current situation:

Filter

filter {
  grok {
    match => { "message" => "%{TIMESTAMP:timestamp} | %{WORD:trackingId} | %{WORD:request} | %{WORD:session} | %{IP:client} | 
      %{WORD:userId} | %{GREEDYDATA:message}" }
  }
}

Log

2017-03-21 11:11:54.731 | myApp_35 | myApp_35 | 69E59F4DACC314C0B11B1A8CEA87F9BB | 127.0.0.1 |  | GET on URL [/api/customer] executed with success in [18555 us].

Apparently this is not working. What am I doing wrong?

Answer 1

Try this

%{TIMESTAMP_ISO8601:timestamp}%{SPACE}\|%{SPACE}%{WORD:trackingId}%{SPACE}\|%{SPACE}%{WORD:request}%{SPACE}\|%{SPACE}%{WORD:session}%{SPACE}\|%{SPACE}%{IP:client}%{SPACE}\|%{SPACE}%{DATA:userId}%{SPACE}\|%{SPACE}%{GREEDYDATA:message}

Based on OPs comment here is another regex with SPACE replaced by \\s*

%{TIMESTAMP_ISO8601:timestamp}\s*\|\s*%{WORD:trackingId}\s*\|\s*%{WORD:request}\s*\|\s*%{WORD:session}\s*\|\s*%{IP:client}\s*\|\s*%{DATA:userId}\s*\|\s*%{GREEDYDATA:message}

I would recommend this site to test your grok regex: https://grokdebug.herokuapp.com/