How to break fileds in tomcat logs

[alok_nashikkar]

I want to break tomcat logs into separate fields based on search criteria but I am not able to acheieve that. My tomcat logs looks something like this:

WARN 2014-02-05 08:00:01,924 http-bio-6080-exec-251|D-abc D-abc U-0 S-b59a4a1e-d388-57a197cabd76 R-UvHm.xyz.ui.web.servlet.download.LocalCloudGetInternalServlet - LocalCloudGetInternalServlet- doGet(): /Sed/Depts/8175 A/1305120_10.avi

I have to filer as caterogy WARN/INFO and also according to domain name mentioned as D-"xyz",filename mentioned as /Sed/Depts/8175 A/1305120_10.avi.

[kristian_kolb]

You can try it out in a search with rex like so;

... | rex "^(?<log_level>[A-Z]+)" | rex "\|(?<domain>\S+)" | rex ":(?<filename>\S+)$" 

If this works out well, you can make them more permanent adding the configurations to props.conf;

[your_sourcetype]
EXTRACT-log_level = ^(?<log_level>[A-Z]+)
EXTRACT-domain = \|(?<domain>\S+)
EXTRACT-file = :(?<filename>\S+)$

/k