Grokking log file

Elastic Stack Logstash
1

I have been using logstash to read a log file in which I have come across with some difficulty in grokking the log statement.

The log pattern is like this

"20160401-00:00:00","abc3ap5a","AB2","EAP-Production(Production/EAI)","160402.0","0.0","5.0",

and I have tried to grok like this

"%{NOTSPACE:Datetime}","%{WORD:Hostname}","%{WORD:Location}","%{PROG:Usage)","%{NUMBER:YYMMDD}","%{NUMBER:HHMM}","%{NUMBER:CPU(%)}",""

Everything looks fine except when I try to run the conf file, it keeps saying

The error reported is:
unmatched close parenthesis: /%{PROG:Usage)/m

I have tried to change the parenthesis for different kinds but the same error pops out. Would anyone can suggest any solution for me. What I need is to extract EAP-Production(Production/EAI) as a whole without changing the log file pattern.

2

unmatched close parenthesis: /%{PROG:Usage)/m

As the error message indicates there's a parenthesis mismatch. You open with a { but close with a ).

But I see no reason to use a grok filter for this. It's CSV data so use the csv filter.

3

It looks like csv format, however, it is a log file which opened with notepad. So isn't that using grok is the best?

4

I recommend you use the csv filter to parse CSV data.

5

Yes, great thanks. It works also.