{"action":"opened","issue":{"url":"https://api.github.com/repos/elastic/beats/issues/2644","repository_url":"https://api.github.com/repos/elastic/beats","labels_url":"https://api.github.com/repos/elastic/beats/issues/2644/labels{/name}","comments_url":"https://api.github.com/repos/elastic/beats/issues/2644/comments","events_url":"https://api.github.com/repos/elastic/beats/issues/2644/events","html_url":"https://github.com/elastic/beats/issues/2644","id":179392551,"number":2644,"title":"Provide basic log parsing capability in filebeat","user":{"login":"ageetha","id":15215071,"avatar_url":"https://avatars.githubusercontent.com/u/15215071?v=3","gravatar_id":"","url":"https://api.github.com/users/ageetha","html_url":"https://github.com/ageetha","followers_url":"https://api.github.com/users/ageetha/followers","following_url":"https://api.github.com/users/ageetha/following{/other_user}","gists_url":"https://api.github.com/users/ageetha/gists{/gist_id}","starred_url":"https://api.github.com/users/ageetha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ageetha/subscriptions","organizations_url":"https://api.github.com/users/ageetha/orgs","repos_url":"https://api.github.com/users/ageetha/repos","events_url":"https://api.github.com/users/ageetha/events{/privacy}","received_events_url":"https://api.github.com/users/ageetha/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-09-27T04:02:25Z","updated_at":"2016-09-27T04:02:25Z","closed_at":null,"body":"We have been extending filebeat to provide basic parsing using Named Regex. The named regex is an optional parameter that can be specified per prospector in filebeat.yml file.  Following is an example. \r\n\r\nparsingRegex: (?P<was_requestHost>\\S+)\\s\\S+\\s\\S+\\s\\[(?P<was_datetime_date>.+)\\]\\s\"(?P<was_requestMethod>\\S+)\\s(?P<was_uriPath>\\S+)(?:\\?)?(?P<was_queryString>\\S+)?\\s(?P<was_requestProtocol>\\S+)\\s(?P<was_responseCode_int>\\S+)\\s(?P<was_bytesReceived_long>\\S+)\\s(?P<was_elapsedTime_long>\\S+)?\r\n\r\nWe have also extended this a little further where \r\na) we can do type conversion from string to int,long,float based on the suffix provided on the field name. \r\nb) convert date from incoming format to ISO-8601 format ( ex: 2015-11-05T08:15:30-05:00)\r\n\r\nWith above extension, we are able to provide a very simple deployment model of Filebeat->Elastic->Kibana.\r\n\r\nWe are keen to contribute this feature back to community "}}
{"actor":{"display_login":"ageetha"}}