Hi all,
there is a strange situation cause my pattern works fine in grokdebug.herokuapp.com and also in a debugger offered by X-Pack, but at runtime ingestion events are tagged with "_grokparsefailure" and I don't understand why. Please can someone help me? Thanks in advance
pipeline conf:
input {
beats {
port => "5043"
}
}
filter {
if "WLS-log" in [tags] {
grok {
patterns_dir => "./patterns"
match => [ "message", "<%{TIMESTAMP_ISO8601:timestamp_log}>\s-\s%{DATA:element}\s-\s%{DATA:id}\s-\s%{DATA:log_level}\s\s%{MSG:msglog}?" ]
}
mutate {
add_field => { "Application" => "WLS-INTRA" }
add_field => { "log_type" => "service-log" }
}
}
}
Pattern:
MSG (.|\r|\n|.)
Follow 3 lines of our log file:
<2018-03-21 14:33:16.717> - SEU - [rJFIp41ZPB4Oc0T0dxkGAjj0Eza2Z4SVW46HEMkaKxuEgpDc6fwr!-172047753!1521637363033] - INFO it.gse.seu.web.task.TasksBean - creating task filters for intranet user: a852197seu
<2018-03-21 14:33:33.056> - SEU - [y_FIw8fl31L85jubyIyZLRASen-7ja_9GjM7C-th61F-YrJwxaoS!-172047753!1521639213029] - INFO i.g.s.w.a.IntranetAuthenticationFilter - user: Mariachiara is logged in
LdapUser {
userId=a852514,
name=Mariachiara,
surname=Cusano,
email=mariachiara.cusano@gse.it,
officeName=Sistemi di Produzione e Consumo,
roles=[TL_INT, ASSIGNER]
}
<2018-03-21 14:33:33.171> - SEU - [y_FIw8fl31L85jubyIyZLRASen-7ja_9GjM7C-th61F-YrJwxaoS!-172047753!1521639213029] - INFO it.gse.seu.web.task.TasksBean - creating task filters for intranet user: a852514