Help with grok pattern for logs parsen in logstash

Hey all,
i have a problem with my grok pattern i have 2 type of logs with have one different and if i create two grok matches with the patterns (all similar until LOGLEVEL pattern) look below:
my logs

[9/16/18 19:58:29:827 CEST] 0000006e SystemOut O CIWEB Warn : [ls94mn(unknown) @ 10.16.60.8] de.abc.response.ImportContactsChoiceList.executeFilter() User with bensl=g5082 not found.
[9/16/18 20:28:53:225 CEST] 000004cc SystemOut O CIWEB Error: [mfbr8qv(unknown) @ 10.16.60.8] com.ibm.ecm.struts.actions.p8.P8RetrieveItemsAction.executeAction()

my grok matches:

grok {
  break_on_match => false
   match => [ "message","%{DATESTAMP:time} %{NOTSPACE} %{NOTSPACE:thread} %{WORD:log-source} [ ]* %{NOTSPACE:sev} %{NOTSPACE:module} %{LOGLEVEL:log-level} \: %{GREEDYDATA:msg}" ]
   match => [ "message","%{DATESTAMP:time} %{NOTSPACE} %{NOTSPACE:thread} %{WORD:log-source} [ ]* %{NOTSPACE:sev} %{NOTSPACE:module} %{LOGLEVEL:log-level}\: %{GREEDYDATA:msg}" ]
 }

If I use this Grok with both matches, the filter only takes the error LogLevel.

please help in that, thank you all

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.