How to match string in grok

[andre22]

Hi,

the last part of my messages looks like these:

Beginn Bürgerliche Dämmerung HH:MM:SS,05:56:19
Zustand: Vor Ende Dämmerung,0
Ende Nautische Dämmerung HH:MM:SS,19:39:04
Windgeschwindigkeit km/h,1.1
Beginn Bürgerliche Dämmerung HH:MM:SS,05:56:19
Tag (0) / Nacht (1) anhand Nautischer Dämmerung,1
Zustand: Nach Beginn Dämmerung,1

The delimiter is the comma, but I don't find a pattern to match anything until the comma.

[andre22]

I tried using a regex for that,:

Beginn Bürgerliche Dämmerung HH:MM:SS,05:56:19

should be matched by:

(?<KNX-Item>[^\,]*),%{NOTSPACE:KNX-Value}

But I don't see these Fields in Kibana.

[YuWatanabe]

I am not sure what you want to express the data in Kibana or from your front-end application but from my experience I would suggest two approaches .

Approach A

(This plan will have each line as separate timeseries event )

If you want to process the section as per line base , then use combination with csv filter and grok filter.

Approach B

(This plan will parse data from the section into per timeseries event.)

If you want to process the section as a whole, then use combination with multiline codec and grok filter.

[YuWatanabe]

@andre22

@andre22

(?<KNX-Item>[^,]*),%{NOTSPACE:KNX-Value}

Try (?<KNX-Item>%{DATA}),%{NOTSPACE:KNX-Value}

[andre22]

The CSV plugin did the trick. Thanks a lot, I was totally focussed on grok.