2

I would like to extract in Kiabana fields from @message field which contains a json. ex: 

Audit{
uuid='xxx-xx-d3sd-fds3-f43',
action='/v1.0/execute/super/method', 
resultCode='SUCCESS', 
browser='null', 
ipAddress='192.168.2.44', 
application='application1', 
timeTaken='167'
}

Having "action" and "application" fields I hope to be able to find top 5 requests that hits the application.

I started with something similar to this:

filter {
    if ([message]~ = "Audit") {
        grok {
            match => {
                "message" => "%{WORD:uuid}, %{WORD:action}, %{WORD:resultCode}, %{WORD:browser}, %{WORD:ipAddress}, %{WORD:application}, %{NUMBER:timeTaken}"
            }
            add_field => ["action", "%{action}"]
            add_field => ["application", "%{application}"]
        }
    }
}

But it seems to be too far from reality.

dev devv
  • 95
  • 4
  • 9

1 Answers1

1

If the content of "Audit" is really in json format, you can use the filter plugin "json"

json{
    source => "Audit"
}

It will do the parsing for you and creates everything. You don't need grok / add_field.

HauLuk
  • 155
  • 1
  • 11