Grok pattern filter Sharepoint

Elastic Stack Logstash
1

Hello guys

I have this Sharepoint log line:
" 02/02/2017 11:30:19.53 w3wp.exe (0x23E8) 0x0DD8 SharePoint Foundation General ad74"
So how can I parse "Sharepoint Foundation" ?
This field means the category so I can't assure the number of words in the string.
Thank you

2

With just a single example of what you want to capture, combined with the fact that your field delimiters (spaces?) appear to be valid inside of a field, coming up with a useful pattern is pretty difficult.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.