Grok pattern with space

[abrejuin (Antoine)]

Hello,

I did not find anything which solves my problem so I hope someone wil be able to help me.

I want to grok this message: (I have no idea of the number of spaces in the message)
2017-07-06 14:15:03,311 | DEBUG | MDM001 | Fin du job de creation des fichiers MDM MDM001_EXTRACT_DATA_MAG

I tried this grok pattern:
%{HTTPDATE_US} +| +%{LOGLEVEL:loglevel} +| +%{DATA:jobname} +| +%{GREEDYDATA:logmessage}

it worked fine in grok debugger but I can only see "logmessage" field in my logstash thanks to GREEDYDATA type.
If I switch type to GREEDYDATA for "loglevel" or "jobname" I will see those fiels with spaces.

Thanks a lot for your help.

Best regards

[abrejuin (Antoine)]

Hi,

Actually, I had grokparsefailure generated by another filter file and that is why my pattern did not work.
It is ok now !