please help me with the GROK pattern for below log message

user_3907963 0
Viewed 38

Below is the log message coming to Kibana, but we need to add filters on any one of the segregations below as each one is representing some unique criteria.

Please help me with the GROK pattern for this.in the below format the actual message is after rest keyword

{"@timestamp":"2021-02-19T10:27:42.275+00:00","severity":"INFO","service":"capp","pid":"19592","thread":"SmsListenerContainer-9","class":"c.o.c.backend.impl.SmsServiceImpl","rest":"[SmsListener] [sendSMS] [63289e8d-13c9-4622-b1a1-548346dd9427] [synemail] [ABSENT] [synfi] [0:0:0:0:0:0:0:1] [N/A] [N/A] [End Method]"}

logstash kibana elasticsearch
1 Answers

To this kinf of use case, you have this online tool that provide a quick way to test/validate expression.

This expression must match our data line :

^\[%{TIMESTAMP_ISO8601:timestamp}\] \[%{LOGLEVEL:loglevel}\s*\] \[%{DATA:thread}?\] \[%{DATA:class}?\] \[%{DATA:action}?\] \[%{DATA:id}?\] \[%{DATA:field1}?\] \[%{DATA:field2}?\] \[%{DATA:field3}?\]

So in file configuration contexte this looks like this :

  filter{
    grok {
        match => { 
          "message" => "^\[%{TIMESTAMP_ISO8601:timestamp}\] \[%{LOGLEVEL:loglevel}\s*\] \[%{DATA:thread}?\] \[%{DATA:class}?\] \[%{DATA:action}?\] \[%{DATA:id}?\] \[%{DATA:field1}?\] \[%{DATA:field2}?\] \[%{DATA:field3}?\]" 
          }
    }
  }
user_5217520
Related