LogStash String message parse to JSON format

Question

I am trying to parse my Log message to a JSON format.

I have the next JSON message as input in LogStash:

    {
    ...
    field 1: xxx,
    message: "----------- SCAN SUMMARY -----------\nKnown viruses: 8520944\nEngine version: 0.102.4\nScanned directories: 408\nScanned files: 1688\nInfected files: 0\nTotal errors: 50\nData scanned: 8.93 MB\nData read: 4.42 MB (ratio 2.02:1)\nTime: 22.052 sec (0 m 22 s)\n",
    fieldX: ...
    }

I would like to convert message field into JSON formatted as:

message: 
{
known_viruses: 8520944,
engine_version: 0.102.4
scanned_directories: 408,
...
}

I have tried to to make it in different steps, first dissect lines by "\n", but doesn't work:

 dissect {
   mapping => {
   "message" => "%{removeField}\n%{viruses}\n%{engine_version}"
   }
 }

also tried whit mutate, but same (doesn't split):

mutate {
    split => ["message", "\n"]
  }
  

and also with ruby (the same):

ruby {
  event["message"] = event["message"].split("\n")
}

Any idea how to convert the message String into a valid JSON format?

Answer 1

If the format is always in the same order you could look into using the grok filter plugin: https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html

The pattern i think might do the trick, if you want to use the numeric value of the time as seconds you can change the pattern a bit, as well as for the file size...:

----------- SCAN SUMMARY -----------\nKnown viruses: %{NUMBER:known_viruses}\nEngine version: %{DATA:engine_version}\nScanned directories: %{NUMBER:scanned_directories}\nScanned files: %{NUMBER:scanned_files}\nInfected files: %{NUMBER:infected_files}\nTotal errors: %{NUMBER:total_errors}\nData scanned: %{DATA:data_scanned}\nData read: %{DATA:data_read}\nTime: %{DATA:time}\n