Find all numbers in a text with

I'm a newbe and trying to find all numbers in text with GROK. I'm using GROK debugger.
My sample text: "Sample content with date 11 22 2022 and entity California and another date 1 1 1999 2-3-2024"

I hope to get an array like this ["11", "22", "2022", ""1", "1", "1999", "2", "3", "2024"]

I tried (with chatGPT, likely to be a newbe too ;-))
%{NUMBER:numbers}
%{NUMBER:num}(?:\s|%{SPACE})+
and several other variants.

All result in just 1 number. Any suggestions?

Theoretically regex is: (?<digit>\d+) but will return only the first match.

filter {
# 1st option:
	grok {
			break_on_match => false
			match => { "message" => ["date %{DATECUSTOM:[@metadata][date1]} %{DATA} date %{DATECUSTOM2:[@metadata][date2]}"] }
			pattern_definitions => { "DATECUSTOM" => "%{MONTHNUM} %{MONTHDAY} %{YEAR}" 
			"DATECUSTOM2" => "%{DATECUSTOM} %{DATE}" }
	}
	
	mutate {
          add_field => { "date" => "%{[@metadata][date1]}%{[@metadata][date2]}" }	  	
    }
    mutate{
	 gsub => ["date", "-", " "]
	 split => { "date" => " " }
	} 
# 2nd option:
   # replace nondigs with space, remove double spaces and split 
	  mutate {
        gsub => ["message", "\D", " ",
        "message", "\s\s", ""
        ]
		split => { "message" => " " }
      }
}

Result:

      "message" => [
        [0] "11",
        [1] "22",
        [2] "20221",
        [3] "1",
        [4] "1999",
        [5] "2",
        [6] "3",
        [7] "2024"
    ],
          "date" => [
        [0] "11",
        [1] "22",
        [2] "20221",
        [3] "1",
        [4] "1999",
        [5] "2",
        [6] "3",
        [7] "2024"
    ]
}

Note: This is made in Logstash

1 Like

Thank you for your quick response! I give it a try soon!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.