Can't parse custom grok expression responsible for extracting file extension


I'm using custom grok pattern to extract file extension from field called message
Here's the configuration snippet:

filter {
	grok {
		match => {
			"message" => "(?<file_ext>(\.[^.\\/:*?"<>|\r\n]+$))"

Here's message field content sample:

asdasdas.txt asdsadsa asdsa.pdf

Here's Grok Debugger screenshot:

And here's the error message:

[ERROR] 2019-09-26 16:01:21.865 [Converge PipelineAction::Reload] agent - Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Expected one of #, {, } at line 39, column 43 (byte 698) after filter {\r\n\tgrok {\r\n\t\tmatch => {\r\n\t\t\t"message" => "(?<file_ext>(\.[^.\\/:*?"", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:incompile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/'", "org/logstash/execution/ initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/reload.rb:37:inexecute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:325:in `block in converge_state'"]}

Any clues what might be the cause for this error? I'm surprised since Debugger shows a positive result.

You have an unquoted double quote in the middle of your double quoted string. Try using


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.