Grok from end of line

Elastic Stack Logstash
1

Hi

I am struggling to extract the correct bit of a log message.

what I want to extract is the AgentID which sits at the end of the string and comprises 8 alphanumerics, a hyphen and then 8 more alphnumerics.

In this case the value I am after is: 1547697e-74b96d16

The message/string looks like this:
"AgentFullPath" => "/root/SiteHome/PNMDemo/DemoTesting/Feb24Project/1547697e-74b96d16"

My grok looks like this:
match=>{"AgentFullPath"=>"%{GREEDYDATA}/%{GREEDYDATA:AgentID}$"}

I am getting everything after the first backslash. So I get this:
"AgentID" => "root/SiteHome/PNMDemo/DemoTesting/Feb24Project/1547697e-74b96d16"

How do I get grok to work backwards along the string from the end of line ($) rather than forwards?

Thanks!

2

If you want the last 17 characters of the string you could use

grok { match => { "AgentFullPath" => "(?<AgentID>.{17}$)" } }

"(?<AgentID>%{BASE16NUM}-%{BASE16NUM}$)" would be another option

Or "/(?<AgentID>[^/]*)$".

3

Thanks Badger

I used the two base16 patterns and it worked great!

Cheers

John