Grok extract the PR number


(Erik) #1

Hey guys,

I have a log file with ~500 lines and I need to extract a few lines. One of the lines I want to extract is: pullrequest=pull request number . Could someone tell me what custom grok pattern I should use to 'only' extract the pull request number? Now I am using the following expression: pullrequest\s*=\s*.?$ .
This expression gives me the whole line, but like I said, I only want the number. With some help of this forum and the grok debugger I created the following expression: (?<=pullrequest=).
.
This expression is working fine within the debugger, but unfortunately I am getting a _grokparsefailure if I use it within my logstash config.

Thanks :)!


(Magnus Bäck) #2

pullrequest=%{INT:name-of-field}$ should work fine (if this is always at the end of the line).


(Erik) #3

Thanks for your quick reply @magnusbaeck

To give you a better understanding, this is how the log file looks like:

[Pipeline] ansiColor
platform=gcp
pullrequest=5678
[Pipeline] {
[Pipeline] checkout
03:56:14 Cloning the remote Git repository 
<rest of log file>

(Magnus Bäck) #4

Okay, and what's the problem with using an expression like the one I gave? Do you have the complete log in a single Logstash event or do you have one event per line?


(Erik) #5

So your expression is (almost) working, this is the output I get now:

pull_request pullrequest=%{INT:pullrequest}$

{
  "pull_request": [
[
  "pullrequest=5678"
]
  ],
  "pullrequest": [
[
  "5678"
]
  ]
}

As you can see I have an ouput of two lines, while I only need the the second one.

Your question: Do you have the complete log in a single Logstash event or do you have one event per line?
Answer: It's one log file with ~500 lines with the following input config:

  codec => multiline {
  pattern => "Started"
  negate => "true"
  what => "previous"
}

(Erik) #6

Oeps, my bad: I used your expression as a custom pattern. Now I am just using the following config and it works as expected:
match => {"message" => "pullrequest=%{INT:pullrequest}$"}

Thanks @magnusbaeck , you helped me a lot :slight_smile:


(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.