Grok pattern won't match

Elastic Stack Logstash
1

I have this pattern:
2017-07-13T00:00:04,621 [WARN ][Client-Push:1:3][PfFwdPointSubscriptionService] SEKHKD is disabled
I am able to match up to [client push1:3]

Using this:
\A%{TIMESTAMP_ISO8601:timestamp}\s+[%{LOGLEVEL:loglevel}\s+][(?(?:[A-Za-z0-]:[0-9]:[0-9]))](?(?:[[^.$]]))

I need to get rid of the square brackets by PfFwdPointSubscriptionService. Seems simple but I may be missing something.

{
"timestamp": [
[
"2017-07-13T00:00:04,621"
]
],
"loglevel": [
[
"WARN"
]
],
"thread": [
[
"Client-Push:1:3"
]
],
"bean": [
[
"[PfFwdPointSubscriptionService]"
]
]
}

2

For the following log->

2017-07-13T00:00:04,621 [WARN ][Client-Push:1:3][PfFwdPointSubscriptionService] SEKHKD is disabled

The Grok pattern is ->

^%{TIMESTAMP_ISO8601:timestamp},%{NUMBER:tz} \[%{LOGLEVEL:loglevel} \]\[%{GREEDYDATA:client_push}\]\[%{GREEDYDATA:Service}\] %{GREEDYDATA:msg}

Output in https://grokdebug.herokuapp.com/

{
  "timestamp": [
    [
      "2017-07-13T00:00:04"
    ]
  ],
  "tz": [
    [
      "621"
    ]
  ],
  "loglevel": [
    [
      "WARN"
    ]
  ],
  "client_push": [
    [
      "Client-Push:1:3"
    ]
  ],
  "Service": [
    [
      "PfFwdPointSubscriptionService"
    ]
  ],
  "msg": [
    [
      "SEKHKD is disabled"
    ]
  ]
}
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.