How can I parse the following string using logstash (grok)?

0
votes

How can I parse the following string::

20160521015157802,PLABATCH,PPSDVALD,2016-05-21 00:23:42,2016-05-21 01:51:57,70,119,0,0,65,0,N

I want all values(comma separated values) in different variable to automate log checking process

using kibana,logstash and elasticsearch

1
elasticsearchlogstashkibana-4logstash-grok
Maybe you should explain what those variables and values are supposed to be? - Val
for example: id=>20160521015157802 timestart=>2016-05-21 00:23:42 timeend=>2016-05-21 01:51:57 passed=>N - Mangeshsn

1 Answers

0
votes

You're really asking us to solve your problem for you. This site is to help people with problems they have already attempted to solve before. In addition, you may want to supply more information such as, what a sample output/result would look like.

If each logline is a series of comma separated values which are always in the same order then you could use the csv filter in logstash with the columns defined.

Example

Input:

12:34, 5555, 13:54

Filter

csv {
  source => "message"
  columns => ['time_in', 'id', 'time_out']
}

Result:

time_in => 12:34
id => 5555
time_out => 13:54