Detect a message containing characters and digits

Elastic Stack Logstash
1

Hello,
i'd like to detect a part from a message matching a specific sentence .
When the searched part doesn't contain numbers it works fine with this grok filter :

match => ["Message" , "(^|\W+)(?<keyword>parsing failed for header from)(\W+|$)"]

it detects the partial message "parsing failed for header from" correctly.
what shall i add to make it detect a message like this :

" warning: get digits failed, (450) "

(the (^|\W+) doesn't seem to do the task )
Thanks in advance .

2

What pattern are you matching against that?

3

hi @Badger do you mean this ?

		match =>{
		"message" =>"%{SYSLOGTIMESTAMP:Date}%{SPACE}%{NOTSPACE:Logsource}%{SPACE}%{WORD:Servertype}:%{SPACE}\[%{WORD:PID}]%{SPACE}%{GREEDYDATA:Message}"
		}
4

What is the complete message that is failing to match?

5

@Badger
here it is

Jan 21 14:04:40.424 OPCM35AVCS207 VCS: [0x00000fd8] warning: get digits failed, (450) - wrong number of arguments or invalid property assignment testing now

6

OK, so that sets

   "Message" => "warning: get digits failed, (450) - wrong number of arguments or invalid property assignment testing now",

What are you matching that to that does not work the way you want?

7

@Badger
I am looking for that part :

match => ["Message" , "(^|\W+)(?warning: get digits failed, (450) - wrong number of arguments or invalid property assignment)(\W+|$)"]

but it doesn't detect the "warning: get digits failed, (450) - wrong number of arguments or invalid property assignment"
i guess it's due to the "(450)" part.

8

That is not a valid regexp. You may need to use markdown to prevent the browser consuming some of the characters in the regexp. Make sure it appears correctly in the preview pane on the right when editing your message.

9

Hi @Badger, i'm sorry i didn't quite get what u mean exactly

10

You say you are using

match => ["Message" , "(^|\W+)(?warning: get digits failed, (450) - wrong number of arguments or invalid property assignment)(\W+|$)"]

but that produces the error

#<RegexpError: undefined group option: /(^|\W+)(?warning: get digits failed, (450) - wrong number of arguments or invalid property assignment)(\W+|$)/m>

which suggests to me that you are not actually using the pattern you say you are, possibly because the browser has consumed #, *, or < characters as markdown.

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.