Skip to content

Instantly share code, notes, and snippets.

@devlatte
Created April 13, 2017 06:11
Show Gist options
  • Save devlatte/b43316f5fc9d12d95b2c79565bffebc3 to your computer and use it in GitHub Desktop.
Save devlatte/b43316f5fc9d12d95b2c79565bffebc3 to your computer and use it in GitHub Desktop.
logstash filter string split with control unicode character(\001, start of heading), or regexp
filter{
ruby {
code => "event.set('message', event.get('message').split(/\001\s+/, -1)); event.set('@timestamp', LogStash::Timestamp.now)"
add_field => {
"time" => "%{[message][0]}"
"level" => "%{[message][1]}"
"thread" => "%{[message][2]}"
"msg" => "%{[message][3]}"
"location" => "%{[message][4]}"
"stacktrace" => "%{[message][5]}"
}
remove_field => ["message"]
}
}
# split second param -1 for empty string
# this might be grok filter usage, but just split and no PATTERN use
# event.set('@timestamp', LogStash::Timestamp.now) for replace filebeat @timestamp with logstash processed time
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment