How parse a multiple objects serialized in log with logstash and grok

Asked Feb 05 '15 at 19:47

Active Feb 05 '15 at 20:04

Viewed 342 times

I'm parsing some log files with grok, but I have the following trace:

[es.org.some.Object[
 attr1=53212
 searchTags=[love, rock]
 ]]
[es.org.some.Object[
 attr1=54612
 searchTags=[love, peace, rock]
 ]]

I use the following expression for one:

%{DATA}\[%{JAVACLASS:Object}\[%{DATA}attr1=%{NUMBER:attr1}%{DATA}searchTags=%{DATA:searchTags}\]\]

but I have serverals... how can I parse this to have the next document:

Object1attr1: 53212
Object1searchTags: [love, rock]
Object2attr1: 54612
Object2searchTags: [love, peace, rock]

This is the best way to do this?

Thanks!! Regards.

edited Feb 05 '15 at 20:04

asked Feb 05 '15 at 19:47

Ganchix

try to use multiline filter to create a line like Object1attr1: 53212 Object1searchTags: [love, rock] http://logstash.net/docs/1.4.2/filters/multiline – kofemann Feb 06 '15 at 13:41

0 Answers0