how can I split custom formated log file into json by using logstash?

Question

My question is related to spliting txt log file logstash log file.I mean that custom-string txt TO json formated but how?

My log like that:

 2017-10-18 18:04:25,194|231|ERROR|Ex:GeneralResource_tr-TR_Title.ResourceKey_1 resource key already added to cache 2017-10-18 18:04:25,194|231|ERROR|Ex:GeneralResource_en-US_Title.ResourceKey_1 resource key already added to cache 2017-10-18 18:04:25,194|231|ERROR|Ex:GeneralResource_en-US_Title.Close_1 resource key already added to cache 2017-10-18 18:04:25,194|231|ERROR|Ex:GeneralResource_tr-TR_Title.Close_1 resource key already added to cache 2017-10-18 18:04:25,194|231|ERROR|Ex:vbfavouriteshortcuts_en-US_newshortcut-item.vbText_0 resource key already added to cache 

My custom template :

TimeStamp|RequestId|LogType|Message

But I want to transfer it json format to use with logstash ? How can I do that?

Answer 1

You can parse the logs with Grok filter plugin in Logstash.

...
filter {
    grok {
        match => {"message" => "%{TIMESTAMP_ISO8601:TimeStamp}\|%{NUMBER:RequestId}\|%{LOGLEVEL:LogType}\|%{GREEDYDATA:Message}"}
    }
}
...