What would be grok filter

Question

This is the following json sample in which I want to filter and index on basis of Client Id and User Id which is in Message tag in json.

"message": "12 Jul 2016 15:28:14,851 http-bio-9080-exec-3 [INFO ]    corporate_access                                    - Request details - Uri: /corporate/create, Ip: x.x.x.x, User id: 12461, Client id:11048",

I want to index the user activity on basis of Client Id and User Id. My filter in logstash conf is :

filter {
  grok {

match => {
        "message" => "Uri: %{URIPATHPARAM:url}%{SPACE}Ip: %{IP:ip},%{SPACE}User id: %{WORD:Userid}, Client id:%{WORD:Clientid}"
}

 }
}

Answer 1

You can use this grok filter:

grok {
    match => {
        "message" => [
            "%{MONTHDAY} %{MONTH} %{YEAR} %{TIME} %{GREEDYDATA} \[%{DATA}\]%{SPACE}%{WORD}%{SPACE}- Request details - Uri: %{URIPATH}, Ip: %{IP}, User id: %{NUMBER:user_id}, Client id: %{NUMBER:client_id}"
        ]
    }
}

Note: I have removed the ** around User id and Client id, since it look like it was just to add emphasis on the interesting parts of the log line. But if you really have ** in your logs, the pattern must be modified with: \*\*User id:\*\* %{NUMBER:user_id}, \*\*Client id:\*\*%{NUMBER:client_id}.

Answer 2

This worked !!

  filter {
      if [type] == "corporate-access" {
        grok {
          break_on_match => false
          match => { "message" => "Uri: %{URIPATHPARAM:url}%{SPACE}" }
           match => { "message" => "User id: %{WORD:Userid}, Client id:%{WORD:Clientid}" }
           add_tag => "%{Userid}"
           add_tag => "%{Clientid}"
           add_tag => "%{url}"

        }
      }