Grok pattern to search

sev=1 proto=TCP

trying to use grok with this pattern because sometimes my log format changes, but the output is TCP and null.. how can I account for a pattern to search the whole string and extract the value?


Hi, I recommend a few changes to your pattern:

  1. Switch the order since sev is first in your string
  2. Change .+ to .*, there are no characters before sev
  3. (Optional) use NUMBER for sev if that value is always numeric

Final pattern:

Let me know if this helps.

sorry I think i needed to be more clear.
I'm trying to write an expression that is able to parse both:

  1. sev=1 proto=TCP
  2. proto=TCP sev=1

Since in my log structure, the position of the values sometimes move around in a new line.

If there are the only two values, I'd suggest a simple OR regex:


Anything beyond two values which can arbitrarily move around will involve a more complex regex pattern.

interesting, thanks for your reply.

So it seems the flow must go in sequential order, and thus there isn't a way for one to write a regex pattern that would start from the beginning search the entire string and extract a match, and then start from the beginning again and continue?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.