input :
Query_time: 0.000148 Lock_time: 0.000023 Rows_sent: 0 Rows_examined: 202
grok pattern is :
Query_time: %{NUMBER:query_time:float}\s+Lock_time: %{NUMBER:lock_time:float}\s+Rows_sent: %{NUMBER:rows_sent:int}\s+Rows_examined: %{NUMBER:rows_examined:int}
and the grok debugger give me this output:
{
"BASE10NUM": [
[
"0.000148",
"0.000023",
"0",
"202"
]
]
}
I didn't keep empty captures.when I modify the pattern like this :
Query_time: %{NUMBER:query_time}\s+Lock_time: %{NUMBER:lock_time}\s+Rows_sent: %{NUMBER:rows_sent}\s+Rows_examined: %{NUMBER:rows_examined}
and this comes out:
{
"query_time": [
[
"0.000148"
]
],
"BASE10NUM": [
[
"0.000148",
"0.000023",
"0",
"202"
]
],
"lock_time": [
[
"0.000023"
]
],
"rows_sent": [
[
"0"
]
],
"rows_examined": [
[
"202"
]
]
}
is this the right pattern??? and where did this "BASE10NUM" come from???
eeeee.....really,really thanks for your help:sob: