How To Dissect Uneven Space In Log With Filebeat Processors

Contents hide

1 How to dissect uneven space in log with filebeat processors

Problem Description:

I have a python microservice that output logs like so:

INFO    ; 2022-12-02 01:30:00; bla bla bla...
DEBUG   ; 2022-12-02 01:30:00; bla bla bla...

Note how the space is different on the loglevel.
I am parsing it like so:

                    - dissect:
                        tokenizer: "%{log.level}    ;%{+timestamp} ; %{?message}"
                        field: "message"
                        target_prefix: ""

Which work for the first line, not the second.
Anyone know if there is a solution for such case?

Thank you.

Solution – 1

You need to use the right-padding modifier

                         add this
                           || 
- dissect:                 vv
    tokenizer: "%{log.level->};%{+timestamp} ; %{?message}"
    field: "message"
    target_prefix: ""

Rate this post