Grok space expression optional

(Rotem Lom) #1

Hi there,
In my environments I have the following log files:

Domain name: WORKGROUP
Console user name:Administrator
Console user groups: [Administrators,]
Logged in users: [Administrator,]
OS version: Windows 10
OS Platform: x64
Current System Time:2018-08-06T04:14:32-07:00

And I use this grok match to parse this line(line by line):

   grok {
    match => { "message" => "%{GREEDYDATA:key_info}:%{GREEDYDATA:value_info}" }

All the line parse well except for the last line,
the problem in this line is the 'space' - as you can see all the line have space between ':' to the value, and in the last line the ':' connected to value.
How can I making a part in the grok expression optional?


An optional space would be \s?
But you have another problem: Your value contains ':', so the first GREEDYDATA includes way too much:

  "key_info": [
      "Current System Time:2018-08-06T04:14:32-07"
  "value_info": [


(The key may contain any character but a colon.)


(The key may contain any character, but as little as possible.)

(Rotem Lom) #3

The first one work great !

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.