Logstash Filter for a custom message

0
votes

I am trying to parse a bunch of strings in Logstash and output is set as ElasticSearch.

Sample input string is: 2016 May 24 10:20:15 User1 CREATE "Create a new folder"

The grok filter is:

match => { "message" => "%{SYSLOGTIMESTAMP:timestamp} %{WORD:user} %{WORD:action_performed} %{WORD:action_description} "}

In Elasticsearch, I am not able to see separate columns for different field such as timstamp, user, action_performed etc.

Instead the whole string is under a single column "message".

I would like to store the information in separate fields instead of just a single column.

Not sure what to change in logstash filter to achieve as desired.

Thanks!

1
elasticsearchlogstashlogstash-grok

1 Answers

0
votes

You need to change your grok pattern with this, i.e. use QUOTEDSTRING instead of WORD and it will work!

match => { "message" => "%{SYSLOGTIMESTAMP:timestamp} %{WORD:user} %{WORD:action_performed} %{QUOTEDSTRING:action_description}"}