Grok - Value could appear or not. multiple rules?

Elastic Stack Logstash
1

I'm working with some logs from squid but one value could appear or not

1621232309.575 1 172.99.6.74 TCP_MEM_HIT/206 3096 GET http://storage.googleapis.com/ - HIER_NONE/- application/octet-stream

1621232309.575 1 172.99.6.74 TCP_MEM_HIT/206 3096 GET http://storage.googleapis.com/ - HIER_NONE/1.1.1.1- application/octet-stream

How can i manage through grok the differences??

2

You can surround part of the grok pattern with ( and )? so that it matches zero or more times.

3

many thanks!!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.