CODEWITHSUNDEEP
elasticsearchlogstashlogstash-grok
Sagar Rout
Sagar Rout

Reputation: 694

logstash grok filter pattern

This is my log files.

Application-log-sample.log

2017-01-03 05:40:49.693 INFO  main --- com.getsentry.raven.DefaultRavenFactory : Using an HTTP connection to Sentry.
2017-01-03 05:40:49.935 INFO  background-preinit --- org.hibernate.validator.internal.util.Version : HV000001: Hibernate Validator 5.2.4.Final

I am getting confuse for grok pattern. Can you someone please suggest something.

Upvotes: 0

Views: 837

Answers (2)

Miso Mijatovic
Miso Mijatovic

Reputation: 357

a simple pattern could be:

^%{TIMESTAMP_ISO8601:event_time}\s+%{LOGLEVEL:level}\s+%{SYSLOGPROG}\s---\s%{JAVACLASS:class}\s+:\s+%{GREEDYDATA:message}$

use https://grokdebug.herokuapp.com/ to build your pattern and http://grokconstructor.appspot.com/do/match to test it on many lines.

you can also configure grok to check multiple patterns (stops at first matched) and to use your own patterns, see reference.

Upvotes: 2

Vivek Sharma
Vivek Sharma

Reputation: 174

You can check your grok pattern is working correct or not without running the configuration file by grok debugger. Here is the link for grok debugger,

https://grokdebug.herokuapp.com

Grok discover will help you to achieve the pattern which ever you needed.

Upvotes: 0

Related Questions