Grok parse failures .. Grok syntax

Elastic Stack Logstash
21

Yeah that may be the case, i have also able to parse without any _grokparsefailure with the following grok.

filter {

          grok {

                  match => { "message" => '\[%{TIMESTAMP_ISO8601:timestamp}\] %{HTTPDUSER:EVENTUSER} %{WORD:EVENT} \[%{NUMBER:ID}:%{GREEDYDATA:STATE}\] %{GREEDYDATA:project} %{HTTPDUSER:USER}/ %{HTTPDUSER:abortedby} "%{GREEDYDATA:PATH}/%{GREEDYDATA:jobName}"\[%{GREEDYDATA:uuid}\]' }

          }

}

[Album] Imgur
22

The problem was with the spacing at this %{HTTPDUSER:abortedby}. This should be without any spaces to the adjacent /.

23

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.