CODEWITHSUNDEEP
logstashlogstash-grok
disney82231
disney82231

Reputation: 199

How can I set logstash conf when different logs input from the same thirty-party equipment

The thirty-party equipment has different logs when a user use differnet commands . EX: log A

Jun  2 16:45:49 host-A; rule='a', type='a', pattern='a', actions_taken='a', event_data='a'

log b

Jun 2 16:52:19 host-A; event='bbb',  user='sss',  com='111'

They don't have the same field when users use differnet commands .

The gork can't only uses one pattern to parse log.

How can I set grok to solve this problem?

Upvotes: 0

Views: 26

Answers (1)

Badger
Badger

Reputation: 4072

Use grok to parse everything up to the semi-colon, then use a kv filter to parse the rest.

Upvotes: 1

Related Questions