Grok Filter Pattern with Comma

Elastic Stack Logstash
1

Hello All,

I need %{GREEDYDATA:Text1} till first comma

Here is the input file data
02/06/2016 01:01:07,Text1Data,Text2Datap1,Text2Datap2,Text2Datap3,1046,547,error

Grok Expression
%{DATESTAMP:Time},%{GREEDYDATA:Text1},%{GREEDYDATA:Text2},%{INT:value1},%{INT:value2},%{GREEDYDATA:Status}

Current Output
{
"Time": [
"02/06/2016 01:01:07"
],
"Text1": [
"Text1Data,Text2Datap1,Text2Datap2"
],
"Text2": [
"Text2Datap3"
],
"value1": [
"1046"
],
"value2": [
"547"
],
"Status": [
"error"
]
}

Expected Output
{
"Time": [
"02/06/2016 01:01:07"
],
"Text1": [
"Text1Data"
],
"Text2": [
"Text2Datap1,Text2Datap2,Text2Datap3"
],
"value1": [
"1046"
],
"value2": [
"547"
],
"Status": [
"error"
]
}

Thanks for your help in Advance

2

The most likely answer is to not use GREEDYDATA. Try (?<Text1>[^,]*) instead of %{GREEDYDATA:Text1}.

1 Like
3

Hello Eric,

Thanks for the response,
As per your suggestion, i have updated expression as below

Pasted image1011×410 12.8 KB

But it gives no match

4

You need to change all the occurrences of GREEDYDATA using the same basic approach as the first.

5

Hello Eric,

If possible, can you please provide me complete expression ?

Thanks

6

%{DATESTAMP:Time},(?<Text1>[^,]*),(?<Text2>[^,]*),%{INT:value1},%{INT:value2},(?<Status>[^,]*)

This is all on one line, obviously.

7

Thanks Eric,

I got correct expected output now,

Pasted image1082×772 24.6 KB

8

Since your input is CSV, why not use the csv filter instead of grok?

1 Like