Trying to parse a custom log using grok

Question

I have the following log:

2016-10-20T23:56:42.000+00:00 clientIp:83.149.9.216 TransactionId=1233 TransactionType=Sell

How can i ignore the words clientIp:, TransactionId= and TransactionType= to match only the values?

If I modify my log to look like this:

2016-10-20T23:56:42.000+00:00 83.149.9.216 1233 Sell

And I use this pattern:

%{TIMESTAMP_ISO8601:timestamp} %{IP:clientIp} %{NUMBER:TransactionId} %{WORD:TransactionType}

It works. So i need a way to read only the values after "word:" or "word="

Alain Collins · Accepted Answer · 2016-10-20 22:23:10Z

1

Your pattern can include literals, e.g.

 TransactionId=%{NUMBER:TransactionId}

answered Oct 20, 2016 at 22:23

Alain Collins

16.4k2 gold badges34 silver badges56 bronze badges

Sign up to request clarification or add additional context in comments.

1 Answer 1