HI,
I'm a elk stack newbie, so please forgive ignorance, I want to extract the data from a logfile which separates most of data using the tilde& vertical bars like below
BOO SF55KCK2O12RVDB~|~6635~|~1~|~Music Instruments~|~1~|~Voice and Sound
I tried the grok debugger with the following I returned nulls:
%{WORD}%{SPACE}%{WORD}~|~ %{INT}~|~%{INT}~|~%{DATA}~|~%{INT}~|~%{DATA}
output:
{
"WORD": [
[
"SN74LVC1G04DBVR"
]
],
"INT": [
[
null,
null,
null
]
],
"DATA": [
[
null,
null
]
]
}
and when I tried to replace the ~|~ with %{NOTSPACE} it didnt work as expected also
%{WORD}%{SPACE}%{WORD}%{NOTSPACE}%{INT}~|~%{INT}~|~%{DATA}~|~%{INT}~|~%{DATA}
output:
{
"WORD": [
[
"BOO",
"SF55KCK2O12RVDB"
]
],
"SPACE": [
[
" "
]
],
"NOTSPACE": [
[
"~|~6635~|~"
]
],
"INT": [
[
"1",
null,
null
]
],
"DATA": [
[
null,
null
]
]
}