Hi, I have a field in my log file, which may sometimes has an entry like 'Hello World' , and if it doesn't has data, it will show just - sign. I gave defined it as '%{GREEDYDATA:helloworld}' , which gives me grokparsefailure when data is -. I cant remove ' ' here, since I don't want that single quo…

Solved by using ('%{GREEDYDATA:helloworld}'|%{GREEDYDATA:helloworld})

How to parse a field which have multiple patterns?

system (system) Closed March 18, 2017, 11:16am 4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Issue with Logstash Grok and special character in field Logstash	4	1424	January 19, 2018
Grok is not parsing GREEDYDATA field Logstash	6	8285	July 6, 2017
Logstash grok parser Logstash	1	346	September 20, 2018
Trouble parsing this statement - help with grok expression Logstash	4	680	July 6, 2017
Grok pattern with space Logstash	2	975	August 4, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

How to parse a field which have multiple patterns?

Related topics