elastic search grok filter

Question

I'v just started to work with ELK and logstash I want to parse my apache custom log I wrote simple logstash pipeline

input {
  beats {
    port => 5044
}
filter {
    grok {
      match => { "message" => "%{COMBINEDAPACHELOG}" }
    }
}

output {
    stdout { codec => rubydebug }
}

I tried with match => { "message" => "%{COMMONAPACHELOG}" }

but it doesn't parse correct my log

Example of my log

10.7.46.39 - - [25/Feb/2021:18:17:08 +0300] "POST /secure/TvmGw6 HTTP/1.1" 200 332
10.4.14.39 - - [25/Feb/2021:18:17:08 +0300] "POST /secure/TvmGw6 HTTP/1.1" 200 332

Could you help me to write correct filter. Thanks

Whats the output that configuration is generating? – llermaly Feb 26 '21 at 14:58 — llermaly, Feb 26 '21 at 14:58

score 2 · Answer 1 · answered Feb 26 '21 at 15:24

Here is the Grok Pattern that matches your log:

%{IP:iPad dress} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] \"%{WORD:verb} %{URIPATH:path} HTTP/%{NUMBER:httpversion}\" %{NUMBER:response} %{NUMBER:bytes}

I have used the Grok Debugger to validate the grik pattern.

elastic search grok filter

1 Answers1