Grok pattern with forward slashes result in grokfailure

Elastic Stack Logstash
1

Hi there,

I am trying to extract path components from a "path-like" string and it fails with grokfailure.

I have been banding my head on walls for houyrs with this. It works in "Grok Debugger", but fails in Logstash.

My data looks like this:
/project-name/app-name/dev/source-name

My pattern is:
/%{GREEDYDATA:project}/%{GREEDYDATA:application}/%{GREEDYDATA:env}/%{GREEDYDATA:source}

Many thanks in advance for your help,
JM

2

This should work as I use a similar method - can you post the full config?

Also try this:

(?:/%{GREEDYDATA:project}/%{GREEDYDATA:application}/%{GREEDYDATA:env}/%{GREEDYDATA:source})

As this is the exact thing I have in my config and is working!

3

I tried your example and it did not work.

Can you please clarify what you mean by the full config?

Here is my filter:

grok {
    keep_empty_captures => "true"
    match => { "cloudwatch_logs.log_group" => "(?:/%{GREEDYDATA:project}/%{GREEDYDATA:application}/%{GREEDYDATA:env}/%{GREEDYDATA:source})"}
}

As well, we are writing logs to AWS Cloudwatch from the application and reading it from the Cloudwatch pluggin in Logstash.

Th name of the log group contains "meta" about the app.

4

You are using cloudwatch_logs.log_group, should this not be: [cloudwatch_logs][log_group]
Im not too familiar with cloudwatch input though.

5

Completely missed this

Using [cloudwatch_logs][log_group] was indeed the solution.

Many thanks for this,
JM

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.