GROK pattern troubles

I cant seem to find a pattern for this custom log file:

CDR|N|05:01:2020 12:00:00:991|TEL|20010|blue02|16285|34|TEL_InitiateCall|AA_Rr_Tenant|blue02-PORT34-0501202011595810:SC:AA_Rr_Tenant:7667320521:17663223511:0501202012000099::
CDR|N|05:01:2020 12:00:01:996|TEL|20011|brown02|16285|23|TEL_DropCall|AA_Rr_Tenant|brown02-PORT23-0501202011585615:EC:02:0501202012000199::

This was my first pass and it would not parse.


Being a newbie I thought I would break down the problem in parts and I have a few questions and lots of problems.

The date and time: I would like to combine
I thought maybe a mix of GROK and REGEX

%{WORD:cdr.LogID}\|%{WORD:cdr.LogID}\|(?<cdr.Date>((?:[:0-9]+))) (?<cdr.Time>((?:[:0-9]+)))

I thought I would have the Date and Time in the first fields under 'cdr" instead of its own field?
A space is added in front of the Month/Year/Minute/Seconds/SSec not how that happened?

  "cdr": [
  "cdr.Date": [
    "05: 01: 2020"
  "cdr.Time": [
    "12: 00: 00: 991"

At the end of the record the fields are little bit different with missing fields:
This was my first pass:


Is there a way to have missing fields where in this case Org. and Des. are not in the second record?


I was testing this pattern on Grok Debugger
I am not sure why the "." makes a difference in the name of the field?

%{USERNAME:cdr.Key}:%{WORD:cdrCDRType}:    This one works
%{USERNAME:cdr.Key}:%{WORD:cdrCDR.Type}:   This one fails 

Example of the working output without the "." in the field name:

  "cdr": [
  "cdrCDRType": [

How was my posting formatting? The posting message suggested I fix the code statements?

As far as I can see the ending curly brace is missing for the cdr.HH field.

Given the structure of the log entry I would also probably recommend using the dissect filter rather than grok.It is generally faster and IMHO easier to use.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.