logstash grok filter pattern

0
votes

This is my log files.

Application-log-sample.log

2017-01-03 05:40:49.693 INFO  main --- com.getsentry.raven.DefaultRavenFactory : Using an HTTP connection to Sentry.
2017-01-03 05:40:49.935 INFO  background-preinit --- org.hibernate.validator.internal.util.Version : HV000001: Hibernate Validator 5.2.4.Final

I am getting confuse for grok pattern. Can you someone please suggest something.

2
elasticsearchlogstashlogstash-grok
You can use Grok Debugger to create Grok Pattern for your log. Check available grok pattern constant here . You can also write your own pattern and define it under pattern.d. - Roopendra

2 Answers

1
votes

a simple pattern could be:

^%{TIMESTAMP_ISO8601:event_time}\s+%{LOGLEVEL:level}\s+%{SYSLOGPROG}\s---\s%{JAVACLASS:class}\s+:\s+%{GREEDYDATA:message}$

use https://grokdebug.herokuapp.com/ to build your pattern and http://grokconstructor.appspot.com/do/match to test it on many lines.

you can also configure grok to check multiple patterns (stops at first matched) and to use your own patterns, see reference.

0
votes

You can check your grok pattern is working correct or not without running the configuration file by grok debugger. Here is the link for grok debugger,

https://grokdebug.herokuapp.com

Grok discover will help you to achieve the pattern which ever you needed.