Grok pattern for data separated by pipe

You can use gsub API to change the pipe "|" to space and the use GROK to extract it.

For example:

filter {
    grok {
            match => ["message","%{DATESTAMP:time}\|%{WORD:LOGLEVEL}\|%{WORD:LOGSOURCE}\|%{WORD:LOGMESSAGE}"]
    }
}

The above configuration is worked on me with your log. Hope this can help you.

use this filter:

it works for me. use this site to verify grok patern, https://grokdebug.herokuapp.com/

(?<date>(([0-9]+)-*)+ ([0-9]+:*)+.*)\|%{WORD:LOGLEVEL}\|%{WORD:LOGSOURCE}\|%{WORD:LOGMESSAGE}

Related