Filtering a log to create new columns with Logstash

Question

I have a custom video server that outputs logs in the following format:

<12>May 18 10:35:53.551 myserver.com host:server: WARNING : call 117 (John Doe): video round trip time of 856 ms observed...

I need to be able to use grok in Logstash to create the following columns:

call -> 117

name -> John Doe

RTT -> 856ms

but I am new to Grok and Logstash. How can I make a start on this?

Answer 1

Grok pattern that will meet your requirement:

\<%{INT:serialno}\>%{SYSLOGTIMESTAMP:timestamp} %{HOSTNAME:hostname} %{WORD:data}\:%{WORD:data}\:  %{LOGLEVEL:log-level} \: %{GREEDYDATA:logmsg} %{INT:call} \(%{GREEDYDATA:name}\)\: %{GREEDYDATA:logmsg} %{INT:RTT} %{WORD:unit} %{GREEDYDATA:logmsg}

You can test the grok pattern with any grok debugger. The one that I have used is https://grokdebug.herokuapp.com/

Here is the screenshot of the output: