Groc Regexs in Logstash

Elastic Stack Logstash
1

I have apache log that I have also added cookie information to. The cookie is a from a wordpress site and I want to get the username out of it, so that I can log users and the pages that they visit. I can use the extended apache match to get most of the info out of the log, but that still leaves behind the cookie and more importantly the username. The usernames can be comprised of any characters that make up an email address. I can match the username out of the cookie in a normal perl style regex but not using the grok regex.

My perl style regex is: wordpress_logged_in_.*=(.*?)% and in the case of the logs below would just match olgadiaz. but I am not sure how to make this work.

Can anyone make a suggestion?

Logs:

123.168.143.34 - - [17/Mar/2016:11:24:51 +0000] "GET /wp-content/uploads/2016/03/jacket1-348x445.jpg HTTP/1.1" 304 - "IpAddress:http://52.30.229.250/product-category/mens-clothing/jacket/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36" "Wp_Cookie:wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_ec9f425feaee4085198b34d71ae7=olgadiaz%7C1459423440%7Co5hnTgHHPhzTGW9eqd9Q8z6i1ROhSyKrnUdU%7C467215defc9117b4946121661975145be894066202dbed2dea2423a37e144f12"
123.168.143.34 - - [17/Mar/2016:11:24:51 +0000] "GET /wp-content/uploads/2016/03/jacket3-348x445.jpg HTTP/1.1" 304 - "IpAddress:http://52.30.229.250/product-category/mens-clothing/jacket/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36" "Wp_Cookie:wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_ec9f425feaee4085198b34d71ae7=olgadiaz%7C1459423440%7Co5hnTgHHPhzTGW9eqd9Q8z6i1ROhSyKQOUKrnUdU%7C46defc9117b4946121661975145be894066202dbed2dea2423a37e144f12"
2

I pull a key and value from my cookie in HTTP logs too. If you first match your whole grok the whole cookie field into a field called myCookie, then you can use the kv filter:

filter {
    grok { ... }
    kv {
        source => "myCookie"
        field_split => "; "
      }
}

Does that do what you need?