How can i specify the end of logs

    down vote


I wanna know how can i specify the end of logs.

this is my logs :

message = state:this is a sate,client_name:user

And my match is :

match => [ "message", "%{DATA:dataAfterClientName},client_name:%{DATA:client_name}"]

in the résult i can see juste the dataAfterClientName = state:this is a sate but i don't get the client_name value.

Any help please

(Magnus Bäck) #2

Avoid using the DATA pattern. In your case it's probably matching too much. In this particular case I'd try using the kv filter instead of grok.

(system) #3