Create custom pattern for specific name

Elastic Stack Logstash
1

Hello all.

i have a problem i can't parse a specific name principal name: tu02612 from my log-entry,
i trid this costum pattern [\s principal name:](?<bensl_name>[a-z0-9]{5,7})[\s] but i didn't get any thing right.
some thing like this:

{
  "bensl_name": [
    [
      "tainer"
    ]
  ]
}

my log file looks like this:

17/18 18:23:52:414 CEST] 000000e7 SystemOut     O 1116543205 [WebContainer : 19] ERROR filenet_error.engine.com.filenet.apiimpl.transport.RequestBroker  - method name: checkNameCollision principal name: tu02612 Global Transaction: true User Transaction: false Exception Info: A uniqueness requirement has been violated. The value for property FolderName of class Folder is not unique.
com.filenet.api.exception.EngineRuntimeException: FNRCE0043E: E_NOT_UNIQUE: A uniqueness requirement has been violated. The value for property FolderName of class Folder is not unique. failedBatchItem=0
	at com.filenet.engine.persist.FolderPersister.checkNameCollision(FolderPersister.java:442)
	at com.filenet.engine.persist.FolderPersister.handleException(FolderPersister.java:246)

i m not able to parse just the content of principal name: tu02612 in the bensl_name field. Can any one help!!!

2

What about %{GREEDYDATA} principal name: %{WORD:bensl_name} ?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.