I cant seem to find a pattern for this custom log file:
CDR|N|05:01:2020 12:00:00:991|TEL|20010|blue02|16285|34|TEL_InitiateCall|AA_Rr_Tenant|blue02-PORT34-0501202011595810:SC:AA_Rr_Tenant:7667320521:17663223511:0501202012000099::
CDR|N|05:01:2020 12:00:01:996|TEL|20011|brown02|16285|23|TEL_DropCall|AA_Rr_Tenant|brown02-PORT23-0501202011585615:EC:02:0501202012000199::
This was my first pass and it would not parse.
%{WORD:cdr.LogID}\|%{WORD:cdr.ReportingMode}\|%{INT:cdr.MM}:%{INT:cdr.DD}:%{INT:cdr.YYYY}%{SPACE}%{INT:cdr.HH:%{INT:cdr.mm}:%{INT:cdr.ss}:%{INT:cdr.sss}\|%{WORD:cdr.ServiceType}\|%{INT:cdr.MessageID}\|%{WORD:cdr.SystemName}\|%{INT:cdr.ProcessID}\|%{INT:cdr.PortNumber}\|%{USERNAME:cdr.ModuleName}\|%{USERNAME:cdr.ApplicationName}\|%{USERNAME:cdr.Key}:%{WORD:cdr.CDR_Type}:%{WORD:cdr.AppName}:%{INT:cdr.Originator}:%{INT:cdr.Destination}:%{INT:cdr.CallStartTime}:%{GREEDYDATA}
Being a newbie I thought I would break down the problem in parts and I have a few questions and lots of problems.
a.
The date and time: I would like to combine
I thought maybe a mix of GROK and REGEX
%{WORD:cdr.LogID}\|%{WORD:cdr.LogID}\|(?<cdr.Date>((?:[:0-9]+))) (?<cdr.Time>((?:[:0-9]+)))
I thought I would have the Date and Time in the first fields under 'cdr" instead of its own field?
A space is added in front of the Month/Year/Minute/Seconds/SSec not how that happened?
{
"cdr": [
"CDR",
"N"
],
"cdr.Date": [
"05: 01: 2020"
],
"cdr.Time": [
"12: 00: 00: 991"
]
}
b.
At the end of the record the fields are little bit different with missing fields:
This was my first pass:
\|%{USERNAME:cdr.Key}:%{WORD:cdr.CDRType}:%{WORD:cdr.AppName}:%{INT:cdr.Originator}:%{INT:cdr.Destination}:%{INT:cdr.Time}:
Is there a way to have missing fields where in this case Org. and Des. are not in the second record?
|blue02-PORT34-0501202011595810:SC:AA_Rr_Tenant:7667320521:17663223511:0501202012000099::
|brown02-PORT23-0501202011585615:EC:02:0501202012000199::
c.
I was testing this pattern on Grok Debugger
I am not sure why the "." makes a difference in the name of the field?
%{USERNAME:cdr.Key}:%{WORD:cdrCDRType}: This one works
%{USERNAME:cdr.Key}:%{WORD:cdrCDR.Type}: This one fails
Example of the working output without the "." in the field name:
{
"cdr": [
"blue02-PORT34-0501202011595810"
],
"cdrCDRType": [
"SC"
]
}
d.
How was my posting formatting? The posting message suggested I fix the code statements?