Grok pattern for data separated by pipe

Question

I have a logfile in which the data is separated by a pipe symbol. "|". An example is below. Does anyone know how to write a GROK pattern to extract it for logstash?

2014-01-07 11:58:48.7694|LOGLEVEL|LOGSOURCE|LOGMESSAGE

Answer 1

You can use gsub API to change the pipe "|" to space and the use GROK to extract it.

For example:

filter {
    grok {
            match => ["message","%{DATESTAMP:time}\|%{WORD:LOGLEVEL}\|%{WORD:LOGSOURCE}\|%{WORD:LOGMESSAGE}"]
    }
}

The above configuration is worked on me with your log. Hope this can help you.

Answer 2

use this filter:

it works for me. use this site to verify grok patern, https://grokdebug.herokuapp.com/

(?<date>(([0-9]+)-*)+ ([0-9]+:*)+.*)\|%{WORD:LOGLEVEL}\|%{WORD:LOGSOURCE}\|%{WORD:LOGMESSAGE}

Answer 3

This worked for me

grok { match => ["message","%{DATESTAMP:time}\|%{WORD:LOGLEVEL}\|%{WORD:LOGSOURCE}\|%{WORD:LOGMESSAGE}"] }

Answer 4

The LOGMESSAGE part can contain a long content. For this reason, I recommend the following usage.

%{GREEDYDATA:LOGMESSAGE}