custom log grok pattern

Question

I am trying to parse a custom log line using grok pattern but I'm not able to completely parse the line.

Custom log line:

site 'TRT' : alias 'TRT,FAK,FAS,ATI,ONE,DVZ,TWO' : serveur 'Test10011' RAS : TRT / TRT serveur 'Test10011' OK

Grok pattern:

%{DATA:site}\:%{DATA:alias}\:%{DATA:server}\:%{DATA:msg}

Result:

{
  "site": [
    [
      "site 'TRT' "
    ]
  ],
  "alias": [
    [
      " alias 'TRT,FAK,FAS,ATI,ONE,DVZ,TWO' "
    ]
  ],
  "server": [
    [
      " serveur 'Test10011' RAS "
    ]
  ],
  "msg": [
    [
      ""
    ]
  ]
}

I am not able to parse the last few items in the 'msg', . Could you please help ,where I'm going wrong? msg should contain "TRT / TRT serveur 'Test10011' OK"

Wiktor Stribiżew · Accepted Answer · 2017-06-07 12:36:04Z

1

It seems you just need to use GREEDYDATA instead of DATA pattern:

%{DATA:site}\s*:\s*%{DATA:alias}\s*:\s*%{DATA:server}\s*:\s*%{GREEDYDATA:msg}

I also suggest adding \s* around : to get rid of leading/trailing whitespaces.

answered Jun 7, 2017 at 12:36

Wiktor Stribiżew

631k41 gold badges502 silver badges632 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

user3758867 Over a year ago

Thanks @Wiktor. Didn't consider GREEDYDATA before :)

Wiktor Stribiżew Over a year ago

Yeah, GREEDYDATA is translated to the .* pattern (a greedy dot matching pattern), and DATA is translated into .*? (lazy dot matching pattern). You may read more about greedy and lazy quantifiers here.

user3758867 Over a year ago

One last thing. In case if I want only 'OK' in 'msg' label how would I remove the characters before OK?

Wiktor Stribiżew Over a year ago

If that word is always at the end and is always preceded with a space, replace the last \s* with .*\s (%{DATA:site}\s*:\s*%{DATA:alias}\s*:\s*%{DATA:server}\s*:.*\s%{GREEDYDATA:msg})

Collectives™ on Stack Overflow

custom log grok pattern

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related