How to extract partial match using grok filtering?

Elastic Stack Logstash
1

Hi,
I am trying to write a logstash conf file with grok filter to find out my cassandra clusters name and datacenter name.

For example: Initial value:
"metric_path": "zabbix_test-us-east-2-node0.KeyCache.HitRate"
Here,

Cluster Name = zabbix_test
Datacenter Name = us-east-2

So my naming convention is:

<cluster_name>-<datacenter name>-node<Number>
So far, I am able to find our instance name using this:

filter {
   grok {
     match => { "metric_path" => "(?<instance_name>[^.]*)" }
   }
}

Can someone please tell me how to extract datacenter name and cluster name from the string?
For example:
datacenter name = us-west-1
cluster name = zabbix_text

Thanks.

2 
(?<cluster>[^-]+)-%{GREEDYDATA:datacenter}-node\d+
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.