简体   繁体   中英

GROK Filter Help Logstash

Hello I am new to GROK learning, I am trying to store following log in seperate fields, having a hard time writing a GROK filter to do it

This is the log

01/04/2021 15:30:00.300 +03:00 - [INFO] - [w3wp/LPAPI-Last Casino/95] - Log Message XXXXXXXXXXXXXXXXXXX

and I want to extract in this pattern

DATE TIME TIMEZONE - [SEVERITY] - [APPLICATION/SUBSYSTEM/THREAD_ID] - MESSAGE

This did the trick

filter { grok { match => { "message" => "%{DATESTAMP:TimeStamp} %{ISO8601_TIMEZONE:TimeZone} - [%{LOGLEVEL:Severity}] - [%{DATA:APPLICATION}/%{DATA:SUBSYSTEM}/%{BASE10NUM:THREAD_ID}] - %{GREEDYDATA}"} } }

The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM