Grok pattern for Logstash input log file

0
votes

[1603870834] SERVICE ALERT: localhost;Swap Usage;OK;SOFT;2;SWAP OK - 1% free (0 MB out of 1023 MB)

I have to filter that string example in JSON format for Logstash it is my Nagios log file output that I have to load into my ELK using Logstash, how I can write to grok for that?

2
stringlogstashlogstash-groknagios

2 Answers

0
votes

In grok there is a dedicated pattern for this type of line : NAGIOSLOGLINE.

So in your case try this :

 filter {
      grok {
        match => { "message" => "%{NAGIOSLOGLINE}" }
      }
    }

For information, you could use grokdebug for test more pattern here.

0
votes

Here is the modified grok pattern of what you have find:

\[%{NUMBER:unix_timestamp}\]\s%{DATA:type}:\s%{DATA:host};%{DATA:service};%{DATA:status};%{DATA:nagios_status};%{DATA:int};%{GREEDYDATA:nagios_message}