How to read data in logs using logstash?

Question

I have just started log stash, i have log files in that log file whole object is printed in the logs, Since my object is huge i cant write the grok patterns to the whole object and also i expecting only two values out of those object. Can you please let us know how can i get that?

my logs files looks like below

2015-06-10 13:02:57,903 your done OBJ[name:test;loc:blr;country:india,acc:test@abe.com]

This is just an example my object has lot attributes in int , in those object i need to get only name and acc.

Regards Mohan.

Answer 1

You can use the following pattern for the same

%{GREEDYDATA}\[name:%{WORD:name};%{GREEDYDATA},acc:%{NOTSPACE:account}\]

GREEDYDATA us defined as follows -

GREEDYDATA .*

The key lie in understanding greedydata macro. It eats up all possible characters as possible.

Answer 2

Logstash patterns don't have to match the entire line. You could also pull the leading information off (date, time, etc) in one grok{} and then use a different grok{} to pull off just the two fields that you want.