Grok parsing issue using parsing log containing text starting [date] [hostname]

Question

I am trying to parse below log using grok

 [2018-10-06 12:04:03:0227] [MYMACHINENAME]

and the grok expression which I used is

/[%{DATESTAMP:date}/] /[%{WORD:data}%/]

and this expression is not working. I tried to replace WORD with hostname even then it not working and if I try to either of the matchers alone then it works. Can anyone provide me the better tutorial pages to learn grok expressions?

Sufiyan Ghori · Accepted Answer · 2018-07-03 22:19:56Z

1

There are few errors in your pattern. First off, you escape character using backslash / not forward slash \. Second, you don't need % to match ] in the end. Third, DATESTAMP doesn't match your date pattern, you need TIMESTAMP_ISO8601.

Your final pattern should become,

\[%{TIMESTAMP_ISO8601}\] \[%{WORD}\]

answered Jul 3, 2018 at 22:19

Sufiyan Ghori

18.9k17 gold badges84 silver badges111 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Prasad Over a year ago

Thank you..How would i get to know to which date pattern it matches?

Alexander Bolshakov · Accepted Answer · 2018-07-03 20:09:36Z

0

Regex pattern DATESTAMP is not correct for your string. Try using TIMESTAMP_ISO8601.

Here you can see all grok regex patterns: grok-patterns.

answered Jul 3, 2018 at 20:09

Alexander Bolshakov

561 silver badge6 bronze badges

Collectives™ on Stack Overflow

Grok parsing issue using parsing log containing text starting [date] [hostname]

2 Answers 2

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related