I'm new to Filebeat and I'm trying to process logs using processors.
Log format:
<timestamp> <severity> [<context>] <message>
For example,
2020-11-03T18:28:32.450-0500 D [initandlisten] listening on port 3000
How can I configure the filebeat to output json like this?
{ "timestamp": "2020-11-03T18:28:32.450-0500", "severity": "D", "context": "initandlisten", "message": "listening on port 3000" }
filebeat.yml I'm currently working on:
filebeat.inputs: - type: log enabled: true path: - /path/to/file - output.console: codec.json: processors: - grok: field: message patterns: - '%{timestamp}%{SPACE}%{severity}%...%{message}'
- How to define a pattern to grok
[<context>]
field? It may or may not exist. - How to convert the message to the desired json format?
没有评论:
发表评论