I have a pattern to match using GROK
Dec 14 03:13:01 ppddc1kfep302 my-checker: Context SHA of VSP Logger Software da39a3ee5e6b4b0d3255bfef95601890afd80709
I have the format below for the match
%{SYSLOGTIMESTAMP}%{SPACE}%{IPORHOST:my_host}%{SPACE}%{DATA}:%{SPACE}Context SHA of %{DATA:software} %{DATA:rel_version} %{WORD:sha}
This works but as you can see rel_version would be blank above but i want to specify that as a defualt value of 1.0.1. How can i do that?
Partly true Shrikant. He didn't mention what he is trying by specifying several lines to figure out the pattern for:
Dec 14 03:13:01 ppddc1kfep302 my-checker: Context SHA of VSP Logger Software da39a3ee5e6b4b0d3255bfef95601890afd80709
Dec 12 12:01:27 ppdtest302 test-checker: Context SHA of TEST Software Version 3.0.1_RC5 0b1f71223180bf0df9330b13e17f8d7c62dfdaad16b97a80b8a25c99409c1109
This pattern is working:
filter {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP}%{SPACE}%{IPORHOST:my_host}%{SPACE}%{DATA}:%{SPACE}Context SHA of %{DATA:software} Software (%{DATA})?%{SPACE}(%{DATA:version})?%{SPACE}%{WORD:hash}" }
}
if (![version]){
mutate { add_field => {"version" => "1.0.1"} }
}
}
I assumed that version is an option filed as well as "Version" text. You cannot use "host" for the field name because LS is using as JSON. If you still want to use it, addd: mutate{ remove_field => ["host"] above grok.
Thanks so much for this Rios. and for the detailed explanantion.
Yes you are right. I have logs that contain version and some that dont. Hence wanted to use multiple pattern matches to match all those conditions. Your example above is exactly what i needed.
I am using multiple pattern matches like that
"%{SYSLOGTIMESTAMP}%{SPACE}%{IPORHOST:xxx_host}%{SPACE}%{DATA}:%{SPACE}Context SHA of %{DATA:software} Software Version %{DATA:rel_version} %{WORD:sha}",
"%{SYSLOGTIMESTAMP}%{SPACE}%{IPORHOST:xxx_host}%{SPACE}%{DATA}:%{SPACE}Context SHA of %{DATA:software}%{SPACE}Software%{DATA:rel_version} %{WORD:sha}",
"%{SYSLOGTIMESTAMP}%{SPACE}%{IPORHOST:xxx_host}%{SPACE}%{DATA}:%{SPACE}Context SHA of %{DATA:software} %{DATA:rel_version} %{WORD:sha}"
Will go ahead and add the mutate part for the second match above where rel_Version could be blank
%{SYSLOGTIMESTAMP}%{SPACE}%{IPORHOST:keno_host}%{SPACE}%{DATA}:%{SPACE}Context SHA of %{DATA:software}%{SPACE}Software%{DATA:rel_version} %{WORD:sha}"
that works perfectly to match this log pattern but need the rel_version above to have 1.0.1
Dec 14 03:13:01 ppddc1kfep302 keno-checker: Context SHA of VSP Logger Software da39a3ee5e6b4b0d3255bfef95601890afd80709
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.