I have path field that can have values as /root/cncnz05msp1da15-n01_logs/a.txt OR /root/cncnz05msp1ts05_logs/a.txt OR /root/cncnz05mspmon_logs/a.txt;
I have below logstash config which is working fine for cncnz05msp1ts05_logs / cncnz05mspmon_logs but not for cncnz05msp1da15-n01_logs. How can I parse the optional field -n01. I tried using %{GREEDYDATA:server}(-...)?_log but its not working.
grok {
break_on_match => false
match => { "path" => "%{GREEDYDATA:root_path}/%{GREEDYDATA:server}/%{GREEDYDATA:filename}" }
match => { "server" => "%{GREEDYDATA:server_info}\_" }
match => { "server_info" => "^(?<NTC>...)(?<Zone>....)(?<VM_rest>.*)" }
match => { "VM_rest" => "(?<VM>....)$" }
}
Result that I want is:
NTC: 3 characters
Zone: 4 characters
MSP/MSP1 (dont capture)
VM: 4 characters just before _ or -