0

I would like to industrialise the creation of fields based on a multiple match regex. My log message has this format:

TIMESTAMP| KEY1 VALUE1: KEY2 VALUE2: KEY3 VALUE3: description

I would like to know if there is a way to create thanks to a generic match the fields:

KEY1=VALUE1, KEY2=VALUE2, KEY3=VALUE3

The goal is to have a generic logstash filter. If I had a new key value in the log, I will not have to change the logstash configuration.

pagid
  • 13,559
  • 11
  • 78
  • 104
Julio
  • 2,493
  • 4
  • 33
  • 53

1 Answers1

1

There is a kv filter that can parse key=value type of things automatically. If you want to parse in the format above, you'll need to resort to ruby code such as in this question/answer: Logstash grok filter - name fields dynamically

Community
  • 1
  • 1
Alcanzar
  • 16,985
  • 6
  • 42
  • 59