Grok pattern OK in debugger, but parse failure in logstash

Elastic Stack Logstash
1

Hello everyone.
I wrote grok pattern, checked it in debugger in Kibana.
Grok pattern OK in debugger, but in logstash i got parse failure.
I tried to debug pattern in logstash with
~/logstash/bin/logstash --path.settings=~/logstash/config -f ~/logstash/config/test.conf --log.level=debug --config.debug > ~/debug.txt
but can't find related output in file ~/debug.txt and/or stdout
Please, tell me what I'm doing wrong?

2

inside my config:
input {
file {
path => "/home/me/test.txt"
sincedb_path => "/home/me/tmp"
start_position => "beginning"
}
}

filter {
  grok {
    match => { "message" => "%{TIMESTAMP_ISO8601:time}%{GREEDYDATA}%{SPACE}Execute%{SPACE}%{WORD:execute}\([channel\(\\"%{WORD:channel}%{GREEDYDATA:test28}" }
  }
}

output {
  stdout { codec => rubydebug }
  file {
    codec => "plain"
    path => "/home/me/log.txt"
  }
}
3

Hi

Can you provide a sample of your input? You could comment out your entire filter{} section and see what you get at stdout{}.

Hope this helps.

4

I'm tried to find out something helpful in debug output for 2 hours, and when I escaped everything with right number of slashes of one, debug output lost two lines which l can't to connect with my problem. But finally I got it. Logstash debug will never helps me.
Thank you for everything.

5

I'm find out solution in wrong number of slashes escaping special characters in my pattern.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.