grok filter for log pattern

Question

I have a log pattern which is this form.

field1|field2|field3|field4|field5| key1=value1 key2=value2 key3=value3

key value pair can some in any order. key2 may be earlier that key1.

I am able to parse the field1-field5. BUt not sure how to do it for key value pairs

%{GREEDYDATA:fieldValue1}\|%{GREEDYDATA:fieldValue2}\|%{GREEDYDATA:fieldValue3}\|%{GREEDYDATA:fieldValue4}\|%{GREEDYDATA:fieldValue5}\|

Can I create a map of key-value in grok and then send specific keys ??? Any advise ?

If there are always 3 key-value pairs, you can just add 3 \s*(?<key>\w+)=(?<value>\w+): try %{GREEDYDATA:fieldValue1}\|%{GREEDYDATA:fieldValue2}\|%{GREEDYDATA:fieldValue3}\|%{GREEDYDATA:fieldValue4}\|%{GREEDYDATA:fieldValue5}\|\s*(?<key>\w+)=(?<value>\w+)\s*(?<key1>\w+)=(?<value1>\w+)\s*(?<key2>\w+)=(?<value2>\w+) — Wiktor Stribiżew
– Wiktor Stribiżew, Commented May 23, 2016 at 11:14

alpert · Accepted Answer · 2016-05-23 11:22:00Z

2

You can use kv filter to parse other part. Like:

grok {
    match => { "message" => "%{GREEDYDATA:fieldValue1}\|%{GREEDYDATA:fieldValue2}\|%{GREEDYDATA:fieldValue3}\|%{GREEDYDATA:fieldValue4}\|%{GREEDYDATA:fieldValue5}\| %{GREEDYDATA:keyValue}" }
 }
kv {
    source => "keyValue"
}

answered May 23, 2016 at 11:22

alpert

4,6751 gold badge21 silver badges28 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

SunilS Over a year ago

Thanks alpert. Perfect ..!!

Collectives™ on Stack Overflow

grok filter for log pattern

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related