_grokparsefailure in Logstash

[Astarandel]

Greetings everyone,

I m pretty new to the whole ELK stack, please excuse me if this seems as a noob question.

I am trying to match the following log message:

frost: (Total of 4 licenses issued; Total of 0 licenses in use)

Using the following grok pattern:

%{WORD:program_name}: (Total of %{BASE10NUM:licenses_total:int} licenses issued; Total of %{BASE10NUM:licenses_in_use:int} licenses in use)

I've tested the pattern with 3 different debuggers and according to them it should be fine. Unfortunately I get _grokparsefailure

Could you please help?

best,

Lyubo

[Badger]

Parentheses have meaning in regular expression (they define capture groups) so you need to escape them.

"%{WORD:program_name}: \(Total of %{BASE10NUM:licenses_total:int} licenses issued; Total of %{BASE10NUM:licenses_in_use:int} licenses in use\)"

[Astarandel]

Hello Badger...they are escaped..for some reason when I pasted the line it was not posted correctly but the line is:

"%{WORD:program_name}: \(Total of %{BASE10NUM:licenses_total:int} licenses issued; Total of %{BASE10NUM:licenses_in_use:int} licenses in use\)"

Sorry about the confusion