Hi. We are having issues with our syntax writing, where we try to extract a length of numbers from a long string that continues on both ends of the wanted piece of numbers. Our theory is that the problem lies within our use of %{GREEDYDATA} to separate the string. We have tried substituting %{GREED…

It was this grok match that was failing as we used parentheses as delimiter without marking them as a character with \. match => { "Bloat" => "%{GREEDYDATA:Bloat2}Time (ms): %{GREEDYDATA:SessionLength}"} This worked. match => { "Bloat" => "%{GREEDYDATA:Bloat2}Time \(ms\): %{GREEDYDATA:SessionLeng…

Discuss the Elastic Stack

Grok parse issue parsing previously parsed string

Elastic Stack Logstash

magnusbaeck (Magnus Bäck) May 2, 2018, 2:26pm 4

[doc][Message] is an array. I'm not sure the grok filter deals with that at all.

Topic		Replies	Views
Logstash _grokparsefailure error Logstash	21	8249	July 19, 2017
Trouble parsing this statement - help with grok expression Logstash	4	687	July 6, 2017
Grokprasefailure Issue with hyphen in the log Logstash	7	4748	July 6, 2017
GREEDYDATA in Grok doesn't pick up a leading [ Logstash	12	832	November 5, 2020
Logstash _grokparsefailure . Unable to find issue Logstash	16	11833	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Grok parse issue parsing previously parsed string

Related topics