Search code examples
elasticsearchlogstashgroklogstash-grok

Grok pattern for Logstash using HTTP POST request as input

I'm using Logstash to process my logs and store them to Elastic Search. I'm using http as input plugin for my logstash.

My http post request is: 

$http.post(url, {type: 'reference error', message: 'y is not defined'});

I would like to store the type and message key as different fields in Elastic Search.

Currently all of the post data is stored as a single field like:

"message":"{\"type\":\"ReferenceError\",\"message\":\"y is not defined\"}"

I think this can be done using grok filter but I have not been able to find a way to do this.

Any help is highly appreciated. Thanks.

Solution

  • If you use the json codec, the information should be split out into fields for you automatically.