grok pattern for log event

Question

I'm a Logstash newbie and I've looked at numerous examples of grok patterns and I'm still struggling to acheive my goal which is to parse the following JSON formatted log event.

{
  "@fields": {
    "level": "DEBUG",
    "mdc": {},
    "file": "SearchServiceImpl.java",
    "class": "com.blah.blah.service.impl.SearchServiceImpl",
    "line_number": "767",
    "method": "getUserSavedSearches"
  },
  "@timestamp": "2015-04-24T12:30:37.953+01:00",
  "@message": "username: admin sessionid: 56cR73aBpuIBzRgIElzLUtJJ method_name: getUserSavedSearches",
  "@source_host": "Kens-MacBook.local"
}

In particular I'd like to extract the session id and username. I'm also hoping I can be pointed to detailed documentation explaining how to use Grok. (I've read the available docs on logstash etc). Any help will be appreciated

Ben Lim Ben Lim · Accepted Answer · 2015-04-27T08:04:06

First, your log format is in JSON. So, in your config you can use json codec to read the log. Then, use GROK to parse the username & session id.

input {
    stdin{
        codec => json
    }
}

filter {
    grok {
        match => [
            "@message", "username: %{USERNAME:username} sessionid: %{NOTSPACE:sessionId} method_name: %{WORD:method_name}"
        ]
    }
}

output {
    stdout { codec => rubydebug }
}

For more detailed document, you can use this site to help you try your grok pattern and this site for the grok pattern that can use.

Here is the sample output:

{
         "@fields" => {
              "level" => "DEBUG",
                "mdc" => {},
               "file" => "SearchServiceImpl.java",
              "class" => "com.blah.blah.service.impl.SearchServiceImpl",
        "line_number" => "767",
             "method" => "getUserSavedSearches"
    },
      "@timestamp" => "2015-04-24T19:30:37.953+08:00",
        "@message" => "username: admin sessionid: 56cR73aBpuIBzRgIElzLUtJJ method_name: getUserSavedSearches",
    "@source_host" => "Kens-MacBook.local",
        "@version" => "1",
            "host" => "BEN_LIM",
        "username" => "admin",
       "sessionId" => "56cR73aBpuIBzRgIElzLUtJJ",
     "method_name" => "getUserSavedSearches"
}

grok pattern for log event

1 Answers