How to parse a field which have multiple patterns?


I have a field in my log file, which may sometimes has an entry like 'Hello World' , and if it doesn't has data, it will show just - sign. I gave defined it as '%{GREEDYDATA:helloworld}' , which gives me grokparsefailure when data is -. I cant remove ' ' here, since I don't want that single quote in my entry, that single quote is meant to distinguish the log entries having white-space. So my question is, How can I parse the data with ' ' and - at the same time?

Thanks in advance

tried (('%{GREEDYDATA:helloworld}')|(%{GREEDYDATA:helloworld})) , but not working

Solved by using ('%{GREEDYDATA:helloworld}'|%{GREEDYDATA:helloworld})

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.