Grok Patterns - Quick question

Hi all,

I think this is a quick clarifying question. With a Grok pattern:

  1. Does the entire string that has been filtered need to be matched with your grok pattern or does the grok pattern pull out what it needs and disregards the rest, example:

this, is, some, string, from, some, log

grok pattern does not find "some" and "log" but matches the rest "this", "is", "string", "from".
Does it then assign what it found to the fields OR
Does it fail because it couldn't match everything.

  1. When you do a match => can you have multiple grok patterns in that block or is it one grok pattern per match => block. Reason asking is that different systems that have the same service but depending on config can send different log info (similar format but additional or less fields).

  2. The documentation on grok from what I have searched for is limited, explains what it is with one or two examples but does not go in depth. Is there any good links or documentation I can be pointed to (and I have tried google for documentation :slight_smile: )

thank you once again

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.