From a1ca0084fc4113ad1c9d51a129ec36307f1638d0 Mon Sep 17 00:00:00 2001 From: Rafael Renan Pacheco Date: Mon, 13 Jan 2020 18:30:12 -0300 Subject: [PATCH] Update intro.adoc (#1522) --- docs/src/main/asciidoc/intro.adoc | 28 ++++++++++++++++++++-------- 1 file changed, 20 insertions(+), 8 deletions(-) diff --git a/docs/src/main/asciidoc/intro.adoc b/docs/src/main/asciidoc/intro.adoc index 46f45c995..34e0fc27b 100644 --- a/docs/src/main/asciidoc/intro.adoc +++ b/docs/src/main/asciidoc/intro.adoc @@ -158,19 +158,31 @@ If you want to use https://www.elastic.co/guide/en/logstash/current/index.html[L [source] filter { - # pattern matching logback pattern - grok { - match => { "message" => "%{TIMESTAMP_ISO8601:timestamp}\s+%{LOGLEVEL:severity}\s+\[%{DATA:service},%{DATA:trace},%{DATA:span},%{DATA:exportable}\]\s+%{DATA:pid}\s+---\s+\[%{DATA:thread}\]\s+%{DATA:class}\s+:\s+%{GREEDYDATA:rest}" } - } + # pattern matching logback pattern + grok { + match => { "message" => "%{TIMESTAMP_ISO8601:timestamp}\s+%{LOGLEVEL:severity}\s+\[%{DATA:service},%{DATA:trace},%{DATA:span},%{DATA:exportable}\]\s+%{DATA:pid}\s+---\s+\[%{DATA:thread}\]\s+%{DATA:class}\s+:\s+%{GREEDYDATA:rest}" } + } + date { + match => ["timestamp", "ISO8601"] + } + mutate { + remove_field => ["timestamp"] + } } NOTE: If you want to use Grok together with the logs from Cloud Foundry, you have to use the following pattern: [source] filter { - # pattern matching logback pattern - grok { - match => { "message" => "(?m)OUT\s+%{TIMESTAMP_ISO8601:timestamp}\s+%{LOGLEVEL:severity}\s+\[%{DATA:service},%{DATA:trace},%{DATA:span},%{DATA:exportable}\]\s+%{DATA:pid}\s+---\s+\[%{DATA:thread}\]\s+%{DATA:class}\s+:\s+%{GREEDYDATA:rest}" } - } + # pattern matching logback pattern + grok { + match => { "message" => "(?m)OUT\s+%{TIMESTAMP_ISO8601:timestamp}\s+%{LOGLEVEL:severity}\s+\[%{DATA:service},%{DATA:trace},%{DATA:span},%{DATA:exportable}\]\s+%{DATA:pid}\s+---\s+\[%{DATA:thread}\]\s+%{DATA:class}\s+:\s+%{GREEDYDATA:rest}" } + } + date { + match => ["timestamp", "ISO8601"] + } + mutate { + remove_field => ["timestamp"] + } } ===== JSON Logback with Logstash