Grok crash if line ending by backslash

Elastic Stack Logstash
1

Hello, i have a field pushed by a beat with this content

"D:\Logs\IIS\test.domain.com\20191219.log

So i write the following grok for extract test.domain.com

grok {
                match => {
                    "[log][file][path]" => [
                        "D:\\Logs\\IIS\\%{GREEDYDATA:application.name}\\"
                    ]
                }
            }

And grok crash with a parse failure, if i try this grok

grok {
                match => {
                    "[log][file][path]" => [
                        "D:\\Logs\\IIS\\%{GREEDYDATA:application.name}\\%{GREEDYDATA}"
                    ]
                }
            }

the output of application.name is : test.domain.com\20191219.log

so my final logstash grok is

grok {
                match => {
                    "[log][file][path]" => [
                        "D:\\Logs\\IIS\\%{GREEDYDATA:application.name}\\2%{GREEDYDATA}"
                    ]
                }
            }

and now it's OK application.name is test.domain.com

if i try on kibana grok debugger the first expression, the output is correct

So is it an issue of grok ?

2

That could be this issue.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.