Grok pattern to search


(par) #1

sev=1 proto=TCP

trying to use grok with this pattern because sometimes my log format changes, but the output is TCP and null.. how can I account for a pattern to search the whole string and extract the value?

(.+proto=?=%{USERNAME:proto})?(.+sev=?=%{USERNAME:sev})?


(Jen Huang) #2

Hi, I recommend a few changes to your pattern:

  1. Switch the order since sev is first in your string
  2. Change .+ to .*, there are no characters before sev
  3. (Optional) use NUMBER for sev if that value is always numeric

Final pattern:
(.*sev=?=%{NUMBER:sev})?(.*proto=?=%{USERNAME:proto})?

Let me know if this helps.


(par) #3

sorry I think i needed to be more clear.
I'm trying to write an expression that is able to parse both:

  1. sev=1 proto=TCP
  2. proto=TCP sev=1

Since in my log structure, the position of the values sometimes move around in a new line.


(Jen Huang) #4

If there are the only two values, I'd suggest a simple OR regex:

(.*proto=?=%{USERNAME:proto}.*sev=?=%{NUMBER:sev})|(.*sev=?=%{NUMBER:sev}.*proto=?=%{USERNAME:proto})

Anything beyond two values which can arbitrarily move around will involve a more complex regex pattern.


(par) #5

interesting, thanks for your reply.

So it seems the flow must go in sequential order, and thus there isn't a way for one to write a regex pattern that would start from the beginning search the entire string and extract a match, and then start from the beginning again and continue?


(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.