grok patterns for mongodb logs

gistfile1.txt

WORDDASH \b[\w-]+\b
QUERY \{ (?<={ ).*(?= } ntoreturn:) \}
MONGODB %{SYSLOGTIMESTAMP:timestamp} \[%{WORD:component}\] %{GREEDYDATA:message}

After extracting [message] using %{MONGODB}, pass [message] through grok once again using %{SLOWQUERY}

SLOWQUERY %{WORD} %{WORDDASH:database}\.%{WORDDASH:collection} %{WORD}: %{QUERY:query} %{WORD}:%{NONNEGINT:ntoreturn} %{WORD}:%{NONNEGINT:ntoskip} %{WORD}:%{NONNEGINT:nscanned}.*nreturned:%{NONNEGINT:nreturned}..+ (?<duration>[0-9]+)ms

query ascent_production_alere1.assay_configurations query: { converted_chromatogram_id: { $in: [ ObjectId('b1cbbf5ce3ab610d74830642') ] } } ntoreturn:1 ntoskip:0 nscanned:1 keyUpdates:0 locks(micros) r:268396 nreturned:1 reslen:1926148 268ms

becomes...

{
  "database": [
    "ascent_production_alere1"
  ],
  "collection": [
    "assay_configurations"
  ],
  "query": [
    "{ converted_chromatogram_id: { $in: [ ObjectId('b1cbbf5ce3ab610d74830642') ] } }"
  ],
  "ntoreturn": [
    "1"
  ],
  "ntoskip": [
    "0"
  ],
  "nscanned": [
    "1"
  ],
  "nreturned": [
    "1"
  ],
  "duration": [
    "268"
  ]
}