ZillaG
(ZillaG)
March 27, 2017, 6:55pm
1
I have the following log...
2017-03-27 14:24:50,607 DEBUG :Finalizer thread [com.company.classname]
...and the following filter
filter {
grok {
match => {
"message" => [
"%{TIMESTAMP_ISO8601:logdate}%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}:%{HELP_WITH_PATTERN:thread}"
]
}
}
}
What should "HELP_WITH_PATTERN" be so I get thread => "Finalizer thread"
ZillaG
(ZillaG)
March 27, 2017, 7:06pm
2
I should read my own posts
you could also create your own pattern:
NOTBRACKET [^[]+
Then call that:
%{TIMESTAMP_ISO8601:logdate}%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}:%{NOTBRACKET:thread}${GREEDYDATA:theRest}
system
(system)
Closed
April 24, 2017, 8:14pm
4
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.