I am trying to write a Grok pattern for the app generated log files. I am unable to filter out few fields. Input Log File
2019-05-02 05:32:41,017 INFO [some_class_name] Property: MatchResult(id=null, symbol=BTC_ETH, a=13172871, b=11372687136, c=1111, d=2222, e=139128979137, f=138713871, number=1.00000000000000000000, price=0.0423000, g=1, h=1, i=0.000100000000000000000000, j=0.000004525972500000000000000000000000000000000, createTime=Thu May 02 05:32:41 UTC 2019)
2019-05-02 11:06:46,356 INFO [Some_class_name] property: User uid:2 Login ip:127.0.0.1
Both of these lines will be in the same log file. I need to filter out every field in it. Ex:
%{DATESTAMP:date} %{LOGLEVEL:log} \[%{DATA:class}\] %{NOTSPACE:Property}\: %{SPACE} %{NOTSPACE:user} %{WORD:uid}
I have tried with this pattern, after uid (for the 2nd line on the log file, I cant get the number i.e. uid:2) Similarly, for the first line, I did till Property: MatchResult, after '(', I cannot get separate fields. I am doing this for the first time. Please let me know if needed more info. Thanks
Try this:
%{DATESTAMP:date} %{LOGLEVEL:log} \[%{DATA:class}\] [P|p]roperty\: (%{NOTSPACE:property}\(%{GREEDYDATA:arguments}\))?( User%{SPACE}(%{NOTSPACE:user})?%{SPACE}uid\:%{WORD:uid} Login ip\:%{IP:ip})?
Tested in Elasticsearch 6.7