How to parse a field which have multiple patterns?

Elastic Stack Logstash
1

Hi,

I have a field in my log file, which may sometimes has an entry like 'Hello World' , and if it doesn't has data, it will show just - sign. I gave defined it as '%{GREEDYDATA:helloworld}' , which gives me grokparsefailure when data is -. I cant remove ' ' here, since I don't want that single quote in my entry, that single quote is meant to distinguish the log entries having white-space. So my question is, How can I parse the data with ' ' and - at the same time?

Thanks in advance

2

tried (('%{GREEDYDATA:helloworld}')|(%{GREEDYDATA:helloworld})) , but not working

3

Solved by using ('%{GREEDYDATA:helloworld}'|%{GREEDYDATA:helloworld})

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.