I want to break tomcat logs into separate fields based on search criteria but I am not able to acheieve that. My tomcat logs looks something like this:
WARN 2014-02-05 08:00:01,924 http-bio-6080-exec-251|D-abc D-abc U-0 S-b59a4a1e-d388-57a197cabd76 R-UvHm.xyz.ui.web.servlet.download.LocalCloudGetInternalServlet - LocalCloudGetInternalServlet- doGet(): /Sed/Depts/8175 A/1305120_10.avi
I have to filer as caterogy WARN/INFO and also according to domain name mentioned as D-"xyz",filename mentioned as /Sed/Depts/8175 A/1305120_10.avi.
You can try it out in a search with rex
like so;
... | rex "^(?<log_level>[A-Z]+)" | rex "\|(?<domain>\S+)" | rex ":(?<filename>\S+)$"
If this works out well, you can make them more permanent adding the configurations to props.conf;
[your_sourcetype]
EXTRACT-log_level = ^(?<log_level>[A-Z]+)
EXTRACT-domain = \|(?<domain>\S+)
EXTRACT-file = :(?<filename>\S+)$
/k