CODEWITHSUNDEEP
logstashfilebeatgrok
Haider
Haider

Reputation: 13

GROK Filter Help Logstash

Hello I am new to GROK learning, I am trying to store following log in seperate fields, having a hard time writing a GROK filter to do it

This is the log

01/04/2021 15:30:00.300 +03:00 - [INFO] - [w3wp/LPAPI-Last Casino/95] - Log Message XXXXXXXXXXXXXXXXXXX

and I want to extract in this pattern

DATE TIME TIMEZONE - [SEVERITY] - [APPLICATION/SUBSYSTEM/THREAD_ID] - MESSAGE

Upvotes: 1

Views: 299

Answers (1)

Haider
Haider

Reputation: 13

This did the trick

filter {
    grok {
        match => { "message" => "%{DATESTAMP:TimeStamp} %{ISO8601_TIMEZONE:TimeZone} - \[%{LOGLEVEL:Severity}] - \[%{DATA:APPLICATION}/%{DATA:SUBSYSTEM}/%{BASE10NUM:THREAD_ID}] - %{GREEDYDATA}"}
    }
}

Upvotes: 0

Related Questions