GROK Expression Invalid JSON

Elastic Stack Elasticsearch
1

Hello - I am attempting to create a GROK expression for an APACHE log. I have gotten the expression working in the GROK debugger and other tools - However when i try to add it in as a line into the Ingestion Pipeline i get the message back that its invalid JSON.

Please can someone tell me where i am going wrong with this :frowning:

%{IPORHOST:source.IP} %{DATA:logname}? %{DATA:username}? \[%{HTTPDATE:apache.access.time}\] \\"%{WORD:http.request.method} %{DATA:http.request.header}\\" %{NUMBER:http.response.status_code:long} (?:%{NUMBER:http.response.body.bytes:long}|-) \\("%{DATA:http.request.referrerurl}\\") \\"%{DATA:user_agent.original}\\"? CF-Ray: %{WORD:http.response.CFRayID}?
2

Can you share the full pipeline plus an example document? Best would be to share the Simulate Pipeline API as it is a breeze for others to reproduce your problem.. See Simulate pipeline API | Elasticsearch Guide [7.17] | Elastic

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.