CODEWITHSUNDEEP
elasticsearchlogstashgrok
supportth
supportth

Reputation: 29

elastic search grok filter

I'v just started to work with ELK and logstash I want to parse my apache custom log I wrote simple logstash pipeline

input {
  beats {
    port => 5044
}
filter {
    grok {
      match => { "message" => "%{COMBINEDAPACHELOG}" }
    }
}

output {
    stdout { codec => rubydebug }
}

I tried with match => { "message" => "%{COMMONAPACHELOG}" }

but it doesn't parse correct my log

Example of my log

10.7.46.39 - - [25/Feb/2021:18:17:08 +0300] "POST /secure/TvmGw6 HTTP/1.1" 200 332
10.4.14.39 - - [25/Feb/2021:18:17:08 +0300] "POST /secure/TvmGw6 HTTP/1.1" 200 332

Could you help me to write correct filter. Thanks

Upvotes: 1

Views: 572

Answers (1)

Sourav
Sourav

Reputation: 3392

Here is the Grok Pattern that matches your log:

%{IP:iPad dress} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] \"%{WORD:verb} %{URIPATH:path} HTTP/%{NUMBER:httpversion}\" %{NUMBER:response} %{NUMBER:bytes}

I have used the Grok Debugger to validate the grik pattern.

Upvotes: 2

Related Questions