Grok debug

(Oleg Inishev) #1

I have problem with my grok filter.
When i adding new pattern in MATCH section ~ 80% message lost.
I check my filter in grok debugger - it's fine
How i can debug (step by step) my filter?
Can i see how grok work with every message?

I want create synthetic test, for 1000 message, and put out logs to file.
Maybe you recomend somthig else.

p.s. if my investigationv will f*ckup i demonstrate my filter for you)))


You can send the output to stdout.

You can tag all documents which dont match your grok filter and improve your expression step-by-step.

You can take some of your 1000 documents and put it into together with your expression.

You could post your GROK Expression with some samples here to get more feedback.

(Oleg Inishev) #3

Thank you! Tomorrow, i will test filter and reply!