vendredi 7 septembre 2018

Grok pattern for graylog

I'm retreiving datas that I want to analyse with Graylog.

Theese datas look like

[{"tag":"DO_SIMU[199].1","value":"False","time":"2018-09-05T14:35:09.1189226+02:00"}]
[{"tag":"DO_SIMU[199].2","value":"True","time":"2018-10-05T14:35:09.1189226+02:00"}]
[{"tag":"asefsfdfsd","value":"135","time":"2018-09-05T14:35:09.1189226+02:00"}]
[{"tag":"tit.1","value":"152.551","time":"2018-09-05T14:35:09.1189226+02:00"}]
[{"tag":"DO_SIMU[1].2551","value":"False","time":"6454-09-05T14:35:09.1189226+02:00"}]
[{"tag":"kfmdsfsmdlf.i1","value":"maman","time":"2018-09-05T14:35:09.1189226+15:251"}]

I have to create for each line a variable called with the value of tag (DO_SIMU[199].1 or kfmdsfsmdlf.i1 for example) and to put in this value the value of value

This last step seems to be easy with json

So I'm looking for create a grok pattern that just return me something like

["DO_SIMU[199].1":"False"}

excluding all the rest.

If somebody have an idea, I thank him in advance.

Aucun commentaire:

Enregistrer un commentaire