Grok pattern to search

[yungdebt (par)]

sev=1 proto=TCP

trying to use grok with this pattern because sometimes my log format changes, but the output is TCP and null.. how can I account for a pattern to search the whole string and extract the value?

(.+proto=?=%{USERNAME:proto})?(.+sev=?=%{USERNAME:sev})?

[jen-huang]

Hi, I recommend a few changes to your pattern:

1. Switch the order since sev is first in your string
2. Change .+ to .*, there are no characters before sev
3. (Optional) use NUMBER for sev if that value is always numeric

Final pattern:
(.*sev=?=%{NUMBER:sev})?(.*proto=?=%{USERNAME:proto})?

Let me know if this helps.

[yungdebt (par)]

sorry I think i needed to be more clear.
I'm trying to write an expression that is able to parse both:

1. sev=1 proto=TCP
2. proto=TCP sev=1

Since in my log structure, the position of the values sometimes move around in a new line.

[jen-huang]

If there are the only two values, I'd suggest a simple OR regex:

(.*proto=?=%{USERNAME:proto}.*sev=?=%{NUMBER:sev})|(.*sev=?=%{NUMBER:sev}.*proto=?=%{USERNAME:proto})

Anything beyond two values which can arbitrarily move around will involve a more complex regex pattern.

[yungdebt (par)]

interesting, thanks for your reply.

So it seems the flow must go in sequential order, and thus there isn't a way for one to write a regex pattern that would start from the beginning search the entire string and extract a match, and then start from the beginning again and continue?