First time with grok

Elastic Stack Elasticsearch
1

Hi there.
I'm trying to use grok for the first time to parse a line log like this:
Mar 15 10:45:13 myapp.com myapp: [Info] <99999999999999> /path/path1: [10.255.255.255:99999] POST /our_queue/worker/import? 204

In the Dev tools, with this syntax

%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:host.hostname} %{DATA:process.name}(:) 
%{LOGLEVEL:log-level} %{GREEDYDATA:message}

But is not working. The Debugger should recognize these predefined patterns, no?

2

You are missing the brackets around the Log Level note the are escaped

%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:host.hostname} %{DATA:process.name}(:) \[%{LOGLEVEL:log-level}\] %{GREEDYDATA:message}

3

Thank you. I wrongly assumed the LOGLEVEL pattern included the square brackets.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.