Grok extract the PR number

[erikkn (Erik)]

Hey guys,

I have a log file with ~500 lines and I need to extract a few lines. One of the lines I want to extract is: pullrequest=pull request number . Could someone tell me what custom grok pattern I should use to 'only' extract the pull request number? Now I am using the following expression: pullrequest\s*=\s*.?$ .
This expression gives me the whole line, but like I said, I only want the number. With some help of this forum and the grok debugger I created the following expression: (?<=pullrequest=). .
This expression is working fine within the debugger, but unfortunately I am getting a _grokparsefailure if I use it within my logstash config.

Thanks :)!

[magnusbaeck (Magnus Bäck)]

pullrequest=%{INT:name-of-field}$ should work fine (if this is always at the end of the line).

[erikkn (Erik)]

Thanks for your quick reply @magnusbaeck

To give you a better understanding, this is how the log file looks like:

[Pipeline] ansiColor
platform=gcp
pullrequest=5678
[Pipeline] {
[Pipeline] checkout
03:56:14 Cloning the remote Git repository 
<rest of log file>

[magnusbaeck (Magnus Bäck)]

Okay, and what's the problem with using an expression like the one I gave? Do you have the complete log in a single Logstash event or do you have one event per line?

[erikkn (Erik)]

So your expression is (almost) working, this is the output I get now:

pull_request pullrequest=%{INT:pullrequest}$

{
  "pull_request": [
[
  "pullrequest=5678"
]
  ],
  "pullrequest": [
[
  "5678"
]
  ]
}

As you can see I have an ouput of two lines, while I only need the the second one.

Your question: Do you have the complete log in a single Logstash event or do you have one event per line?
Answer: It's one log file with ~500 lines with the following input config:

  codec => multiline {
  pattern => "Started"
  negate => "true"
  what => "previous"
}

[erikkn (Erik)]

Oeps, my bad: I used your expression as a custom pattern. Now I am just using the following config and it works as expected:
match => {"message" => "pullrequest=%{INT:pullrequest}$"}

Thanks @magnusbaeck , you helped me a lot