Logstash Grok Pattern for Rails 4? -

anyone have logstash pattern ruby on rails 4 multiline logs?

i have pattern rails 3, has different log structure:

ruuid \h{32} # rails controller action rcontroller (?<controller>[^#]+)#(?<action>\w+) # line: rails4head (?m)started %{word:verb} "%{uripathparam:request}" % {iporhost:clientip} @ (?<timestamp>%{year}-%{monthnum}-%{monthday} %{hour}:%{minute}$ # strange reason, params stripped of {} - not sure that's idea. rprocessing \w*processing %{rcontroller} (?<format>\s+)(?:\w*parameters: {%{data:params}}\w*)? rails4foot completed %{number:response}%{data} in %{number:totalms}ms %{greedydata} rails4profile (?:\(views: %{number:viewms}ms \| activerecord: %{number:activerecordms}ms|\(activerecord: %{number:activerecordms}ms)? # putting rails4 %{rails4head}(?:%{rprocessing})?(?<context>(?:%{data}\n)*)(?:%{rails4foot})? 

rails 4 logs in format, includes timestamp , looks id (#).

i, [2016-01-26t23:21:44.581108 #27447]  info -- : started "/login" xxx.xxx.xxx.xxx @ 2016-01-26 23:21:44 -0800 

i searched lot rails4 grok pattern, no hope.

i found alternatives i'm using now, might helpful people having same problem.

approach #1

first, add lograge gem application. gem simplify rails log can parse using grok.

then can use following pattern

lograge %{word:method}%{space}%{data}%{space}action=%{word:controller}#%{word:action}%{space}status=%{int:status}%{space}duration=%{number:duration}%{space}view=%{number:view}(%{space}db=%{number:db})?%{greedydata} 

this method mentioned in article.

approach #2

as alternative, can use json filter in following article different lograge configurations.

filter {   json {     source => "short_message"     remove_field => "short_message"   } }