Filter for When Log changes Slightly

How do you create a grok pattern that can handle the log changing every now and then so I have a filter written that works but every so often the last field of an almost identical log is empty and the existing filter cant handle it.
e.g Logs

"MAR-21 00:43:38||2|CN=Test.Test,OU=alpha Users,OU=alpha,OU=Test Units,DC=alphadev,DC=dev,DC=abc,DC=ca|foJ16BD1/B42LI5Cfke/D4oDcUA=|ABCDEF"

"12-MAR-21 07:50:06||10|CN=ez91288,OU=BEV Users,OU=BEV,OU=Business Units,DC=alpha,DC=corp,DC=abc,DC=ca|+uOdgwg5RbNyjjd8JYBtk2K6yH8=|"

so the 2nd log doesn't have the field "|ABCDEF" so it breaks parsing.

%{GREEDYDATA:timestamp}\|%{IPV4:src_ip}\|%{WORD:event_id}\|%{GREEDYDATA:DN}\|%{NOTSPACE:session}\|%{NOTSPACE:application} | 

If a grok field is optional then you can surround it with ()? (i.e. zero or more of the capture group) to tell grok that.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.