January 2019
Beginner
172 pages
4h 9m
English
Using Grok Debugger, we can create the pattern to parse any sample unstructured data, which can be a line of any log file or any file data. Once that unstructured data is parsed through the created pattern, we can generate the structured data, which can easily be analyzed in Elasticsearch using Kibana. For example, we might have the following sample data:
127.0.0.1 GET /index.php 11374 0.019
We can create a pattern like following to process it:
%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}
After simulating the Grok Pattern, we can convert the preceding sample unstructured data into structured data:
{ "duration": "0.019", "request": "/index.php", "method": "GET", "bytes": "11374", "client": ...Read now
Unlock full access