Escape specialcharacters in grok

Elastic Stack Beats
1

How do we escape special characters in grok pattern.
The below fails on this text.
Log Line :
2019-09-03 11:52:56.387 - [INFO] - from [Class:xxx.yyy.CLASSNAME Method:METHOD] in 29 - Invalid Key and Password 1234567XXXXXX YYYYY
Grok Pattern:
%{TIMESTAMP_ISO8601:LogTimestamp} - \[%{LOGLEVEL:Loglevel}\] - from \[Class:%{JAVACLASS:Classname} Method:%{WORD:Method}\] in %{NUMBER:num} - Invalid Key and Password %{WORD:Key} %{WORD:Password}

Whenever there is some special chars in last word ie. $YYYYY or YYY$YY , the grok fails. Can you please help me what should be done here to escape special chars ?

2

Hi @Tinkerbell,

WORD is not the right pattern for a password. Perhaps in this case you could use %{GREEDYDATA}? It will catch anything beyond that point. You can check the full list of available patterns here: https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/grok-patterns

3

GREEDYDATA doesnot work. How do we use patterns in grok expressions ?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.