Customer pattern to parse specific data

(brouk) #1


i have a problem with my logfiles i want to create a grok pattern which can chek if this log-entry have after sev field a string starrt whit com than parse it in package. i try this pattern but not lukcy:


[9/17/18 4:48:10:436 CEST] 00000072 webapp E com logServletError SRVE0293E: [Servlet Error]-[PluginServlet]: Plugin resource not found!

my pattern:

%{DATESTAMP:time} %{NOTSPACE} %{NOTSPACE:thread} %{WORD:log-source} [ ]* %{NOTSPACE:sev}\s+(?<package>[a-z]{3}(?=.*c))\s ?%{GREEDYDATA:msg}

please help me.
Thank you


Use this tool to help you construct and test your grok patterns.

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.