def elasticsearch(line):
<EOL>elasticsearch_log = line<EOL>actuallog = re.findall(r'<STR_LIT>', elasticsearch_log)<EOL>if len(actuallog) == <NUM_LIT:1>:<EOL><INDENT>keys = ['<STR_LIT>','<STR_LIT>','<STR_LIT:message>','<STR_LIT>','<STR_LIT>','<STR_LIT>','<STR_LIT>', '<STR_LIT>']<EOL>values = re.findall(r'<STR_LIT>', actuallog[<NUM_LIT:0>])<EOL>for index, i in enumerate(values):<EOL><INDENT>if not isinstance(i, str):<EOL><INDENT>continue<EOL><DEDENT>if len(re.findall(r'<STR_LIT>', i)) > <NUM_LIT:0> and '<STR_LIT>' in re.findall(r'<STR_LIT>', i)[<NUM_LIT:0>]:<EOL><INDENT>num = re.split('<STR_LIT>', i)[<NUM_LIT:0>]<EOL>values[index]  = float(num)<EOL>continue<EOL><DEDENT>if len(re.findall(r'<STR_LIT>', i)) > <NUM_LIT:0> and '<STR_LIT:s>' in re.findall(r'<STR_LIT>', i)[<NUM_LIT:0>]:<EOL><INDENT>num = re.split('<STR_LIT:s>', i)[<NUM_LIT:0>]<EOL>values[index] = float(num) * <NUM_LIT:1000><EOL>continue<EOL><DEDENT><DEDENT>data = dict(zip(keys,values))<EOL>if '<STR_LIT>' in data and data['<STR_LIT>'][-<NUM_LIT:1>] == '<STR_LIT:U+0020>':<EOL><INDENT>data['<STR_LIT>'] = data['<STR_LIT>'][:-<NUM_LIT:1>]<EOL><DEDENT>if '<STR_LIT>' in data:<EOL><INDENT>data['<STR_LIT>'] = float(data['<STR_LIT>'])<EOL><DEDENT>event = data['<STR_LIT:message>']<EOL>level=values[<NUM_LIT:1>]<EOL>timestamp=values[<NUM_LIT:0>]<EOL>return dict(<EOL>timestamp=timestamp,<EOL>level=level,<EOL>type='<STR_LIT>',<EOL>data=data,<EOL>event=event<EOL>)<EOL><DEDENT>else:<EOL><INDENT>return dict(<EOL>timestamp=datetime.datetime.isoformat(datetime.datetime.now()),<EOL>data={'<STR_LIT>': line}<EOL>)<EOL><DEDENT>
>>> import pprint
>>> input_line = '[2017-08-30T06:27:19,158] [WARN ][o.e.m.j.JvmGcMonitorService] [Glsuj_2] [gc][296816] overhead, spent [1.2s] collecting in the last [1.3s]'
>>> output_line = elasticsearch(input_line)
>>> pprint.pprint(output_line)
{'data': {'garbage_collector': 'gc',
          'gc_count': 296816.0,
          'level': 'WARN',
          'message': 'o.e.m.j.JvmGcMonitorService',
          'plugin': 'Glsuj_2',
          'query_time_ms': 1200.0,
          'resp_time_ms': 1300.0,
          'timestamp': '2017-08-30T06:27:19,158'},
 'event': 'o.e.m.j.JvmGcMonitorService',
 'level': 'WARN ',
 'timestamp': '2017-08-30T06:27:19,158',
 'type': 'metric'}

Case 2:
[2017-09-13T23:15:00,415][WARN ][o.e.i.e.Engine           ] [Glsuj_2] [filebeat-2017.09.09][3] failed engine [index]
java.nio.file.FileSystemException: /home/user/elasticsearch/data/nodes/0/indices/jsVSO6f3Rl-wwBpQyNRCbQ/3/index/_0.fdx: Too many open files
        at sun.nio.fs.UnixException.translateToIOException(UnixException.java:91) ~[?:?]