Logstash Grok过滤器模式

Question

This is my log files.

Application-log-sample.log

2017-01-03 05:40:49.693 INFO  main --- com.getsentry.raven.DefaultRavenFactory : Using an HTTP connection to Sentry.
2017-01-03 05:40:49.935 INFO  background-preinit --- org.hibernate.validator.internal.util.Version : HV000001: Hibernate Validator 5.2.4.Final

I am getting confuse for grok pattern. Can you someone please suggest something.

Answer 1

a simple pattern could be:

^%{TIMESTAMP_ISO8601:event_time}\s+%{LOGLEVEL:level}\s+%{SYSLOGPROG}\s---\s%{JAVACLASS:class}\s+:\s+%{GREEDYDATA:message}$

use https://grokdebug.herokuapp.com/ to build your pattern and http://grokconstructor.appspot.com/do/match to test it on many lines.

you can also configure grok to check multiple patterns (stops at first matched) and to use your own patterns, see reference .

Answer 2

You can check your grok pattern is working correct or not without running the configuration file by grok debugger. Here is the link for grok debugger,

https://grokdebug.herokuapp.com

Grok discover will help you to achieve the pattern which ever you needed.