Monolog Logstash Config example

logstash.conf

input {
  stdin { codec => "plain" }
}

filter {
  # Pulls out fields from monolog text log. (Note, we don't send extra to our monolog)
  grok {
    match => [ "message", "%{MONOLOG} %{GREEDYDATA:mymessage}"]
  }

  json {
    source => "context"
  }
}

output {
  stdout { codec => rubydebug }
}

Hey, where does MONOLOG come from?

(Monolog pattern):

# Define Monolog pattern
MONOLOG \[%{TIMESTAMP_ISO8601:timestamp}\] %{DATA:logger}.%{LOGLEVEL:level}:

Or inline:

\[%{TIMESTAMP_ISO8601:timestamp}\] %{DATA:logger}.%{LOGLEVEL:level}: %{GREEDYDATA:message}

Log input example:

[2016-03-29 10:27:03] payroll-app.request.INFO: 204 PUT /employments/1/integration/status

Event output exemple:

{
  "timestamp": [
    [
      "2016-03-29 10:27:03"
    ]
  ],
  "logger": [
    [
      "payroll-app.request"
    ]
  ],
  "level": [
    [
      "INFO"
    ]
  ],
  "message": [
    [
      "204 PUT /employments/1/integration/status"
    ]
  ]
}

You need to add overwrite => [ "message" ] to set properly the message field.