I am encountering the following problem: I have been filtering out the "Via_IP1" field from "Via1" which matches on both grok debugger and grok constructor.But when running on logstash ,i could observe grokparsefailure in my tag.
i am using below grok filter ,
grok{
id => "grok5"
match => {"via1" => "^(?:.*SIP/2.0/UDP)(?<Via_IP1>[\s]\d+.\d+.\d+.\d+)?(?:.*)?$" }
}
when we commented out the grok specified above(grok5 and grok6) grokfailure doesn't occur.
Well, that's a pretty good clue. If we look at the grok6 filter it expects the field to contain "SIP/2.0/UDP" but the via2 field doesn't contain that string.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.