This is a logstash output filter for kibana for a django application log based on grok filter. Using this output filter it is possible to parse the unstructured data in to something structured and queryable.

11-applog-filter.conf

filter {
  if [type] == "applog" {
    grok {
      match => { "message" => "%{SYSLOG5424SD} ([Ww]arning|WARNING|[Ee]rror|ERROR|[Ii]nfo|INFO) (%{SYSLOG5424SD} Not Found: %{URIPATH})?" }
      add_field => [ "received_at", "%{@timestamp}" ]
      add_field => [ "received_from", "%{host}" ]
    }
    syslog_pri { }
    date {
      match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
    }
  }
}

#log samples

# [17/Mar/2017 20:00:48] WARNING [/home/ubuntu/virtual-env/app/local/lib/python2.7/site-packages/django/core/handlers/base.py:145] Not Found: /api/new_version

# [06/May/2016 15:07:22] INFO [/home/ubuntu/app/api/api.py:106] demo@app.com logging to app platform

# [12/May/2016 11:06:59] ERROR [/home/ubuntu/app/order/tasks.py:504] Retrying connect to app