2021年1月21日星期四

how to convert plain text log to json using filebeat processor?

I'm new to Filebeat and I'm trying to process logs using processors.

Log format:

<timestamp> <severity> [<context>] <message>  

For example,

2020-11-03T18:28:32.450-0500 D [initandlisten] listening on port 3000  

How can I configure the filebeat to output json like this?

{    "timestamp": "2020-11-03T18:28:32.450-0500",    "severity": "D",    "context": "initandlisten",    "message": "listening on port 3000"  }  

filebeat.yml I'm currently working on:

filebeat.inputs:  - type: log    enabled: true    path:      - /path/to/file    - output.console:    codec.json:    processors:  - grok:      field: message      patterns:      - '%{timestamp}%{SPACE}%{severity}%...%{message}'  
  1. How to define a pattern to grok [<context>] field? It may or may not exist.
  2. How to convert the message to the desired json format?
https://stackoverflow.com/questions/65839589/how-to-convert-plain-text-log-to-json-using-filebeat-processor January 22, 2021 at 01:05PM

没有评论:

发表评论