How to grok first line from an XML format

Hi All,

I am quite new to the magic world of Grok. Any help will be thankful.

I need to apply filter for the following file.

2022-08-22 22:18:59 , 666 INFO @ (blockurcolumn-11) [rbbit_MQ_Versa.appache 75] start collection of :
messageid: 8765568

<sol:create Id="8765568">
</sol:create Id>

The grok pattern i am trying to use
(?m)(?<Rabbit_datetimeTMP>.{23}) %{LOGLEVEL:Level}.messageid:\s%{BASE10NUM:Id}

I need to grok the datetime logelevel message id and the first line of xml(</Xml-fragment xmlns: sol ="" xmlns:ns2="">) . starts with< and ends with >.
unfortunately its taking the entire xml format.

Please do not post pictures of text. Some people cannot read them and they make it impossible to copy and paste data to try to reproduce and resolve a problem. Also, you need to use the </> button in the toolbar above the edit pane to quote your XML to avoid it being consumed as HTML. At the time of my writing your question makes no sense because some of the text is invisible.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.