I am trying to generate pie chart based on the final status of the job from RM logs. Since "RESULT=" string is in the "message" of the log, we are not able to extract it.
After doing some research we came to know that we need to write a grok pattern to break this string and extract "RESULT=".
Here is the string that I want to break, I want to extract user and result from this.
message:2017-02-28 21:24:44,223 INFO resourcemanager.RMAuditLogger (RMAuditLogger.java:logSuccess(191)) - USER=test1 OPERATION=Application Finished - Succeeded TARGET=RMAppManager RESULT=SUCCESS APPID=application_1486072728057_33195