Hi there,
In my environments I have the following log files:
Domain name: WORKGROUP
Console user name:Administrator
Console user groups: [Administrators,]
Logged in users: [Administrator,]
OS version: Windows 10
OS Platform: x64
Current System Time:2018-08-06T04:14:32-07:00
And I use this grok match to parse this line(line by line):
grok {
match => { "message" => "%{GREEDYDATA:key_info}:%{GREEDYDATA:value_info}" }
}
All the line parse well except for the last line,
the problem in this line is the 'space' - as you can see all the line have space between ':' to the value, and in the last line the ':' connected to value.
How can I making a part in the grok expression optional?
Thanks
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.