grok filter for logstash

Question

My log file has lines of the form:

10/13 14:05:18.192 [modulename]: [pid]: (debug level string): message string XYZ:<xyz value>

where

• modulename is a string
• pid is an integer number
• debug level string is a string like "debug" or "info" or "error"
• message string is a string
• xyz value is an integer number

example:

10/13 14:05:18.192 [MyModule]: [12345]: (debug): This is my message. XYZ: 987

I searched around and tried a few things, but am getting _grokparsefailure . Can someone help show me what filter I can use in logstash to parse these logs?

Answer 1

First of all {GREEDYDATA} means until the end of a logging event. So, all the text that resides after dbg_lvl will be assigned to {GREEDYDATA}

Here, try the following code. The problem with your code filter was it was not able to parse anything after msg . Hope this helps.

(?<date>\\d\\d/\\d\\d) %{TIME:time} \\[%{WORD:module}\\]: \\[%{WORD:pid}\\]: \\(%{WORD:log_level}\\): %{CISCO_REASON}. %{WORD}: %{BASE10NUM:xyz_number}