Custom pattern not working

[Nee_Defeng]

hi guys, I want to parse the value like 'ABC_100', and I am trying to use the custom pattern as this: ALPHANUM %{WORD}_%{NUMBER}

When I use the GROK pattern in the filter as %{ALPHANUM:alphanumber}, it is not parsed, but if I use '%{WORD}_%{NUMBER}' directly in GROK filter, ABC_100 can be parsed into WORD and NUMBER respectively.

My question is: can I define a custom pattern name to represent %{WORD}_%{NUMBER}?

[Badger]

@Nee_Defeng

if I use '%{WORD}_%{NUMBER}' directly in GROK filter, ABC_100 can be parsed into WORD and NUMBER respectively.

Really? I get a _grokparsefailure from

input { generator { count => 1 lines => [ 'ABC_199' ] } }
filter { grok { match => { "message" => "%{WORD}_%{NUMBER}" } } }
output { stdout { codec => rubydebug { metadata => false } } }

The problem is that WORD matches \b\w+\b, and \w matches letters, numbers, and underscore, so WORD consumes the entire message, leaving nothing for the _ and NUMBER to match. If you replace _ with = in both message and pattern it will match.

[Nee_Defeng]

Yes, Badger, you are correct. I have test the 'MYCODE [a-zA-Z]+_%{NUMBER}' in pattern and it is working. Thanks again.