How to grok log file with 2 line formats?

Elastic Stack Logstash
1

iughikugkgkjk

2

You can pass grok an array of patterns and it will try each in turn. Like this...

    grok {
        match => { "message" => [
            '^%{IPORHOST:clientip} - - \[%{HTTPDATE:time_local}\] "%{WORD:action} /%{DATA:application}/%{DATA:ressource}%{WORD}=%{DATA:SAG} %{WORD:protocol}/%{NUMBER:protocol_num}" %{INT:status} %{NUMBER:bytes_sent} %{DATA} "%{DATA:http_user_agent}" %{DATA} %{IP:Address}:%{NUMBER:port_num} %{NUMBER:value1} %{NUMBER:value2} %{NUMBER:value3}',
            '^%{IPORHOST:clientip} - - \[%{HTTPDATE:time_local}\] "%{WORD:action} /%{DATA:application}/%{DATA:ressource}%{WORD}=%{DATA:SAG} %{WORD:protocol}/%{NUMBER:protocol_num}" %{INT:status} %{NUMBER:bytes_sent} %{DATA} "%{DATA:http_user_agent}" %{DATA} %{IP:fe1}:%{NUMBER:port_num1}, %{IP:fe2}:%{NUMBER:port_num2} %{NUMBER:value1}, - %{BASE10NUM:value2}, - %{BASE10NUM:value3}, - %{BASE10NUM:value4}'
            ]
        }

If a line would fit multiple patterns (not the case here) you need to make sure the more specific pattern is earlier in the list.

3

buhjklgbk

4

thank u very much !! it works now !!

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.