im working on writing logstash grok filter syslog messages coming synology box. example message looks this.
jun 3 09:39:29 diskstation connection user:\tuser [user] logged in [192.168.1.121] via [dsm].
im having hard time filtering out weirdly formatted timestamp. give me helping hand here? have far.
if [type] == "syslog" , [message] =~ "diskstation" { grok { match => [ "message", "%{hostname:hostname} %{word:program} %{greedydata:syslog_message}" ] } }
as can tell havent dealt timestamp yet @ all. appreciated.
the following config can parse log.
grok { match => [ "message", "%{syslogtimestamp:date} %{hostname:hostname} %{word:program} %{greedydata:syslog_message}" ] }
you can try log , pattern @ here , refer provided pattern @ here.
Comments
Post a Comment