How to split Grok Message


(Sripal) #1

Hi All,

I'm trying to read the access log using gork filter. but i am unable to split the message.
can anybody help.

Here is my config file and sample output

Thanks in advance .

Sripal


(Christian Dahlqvist) #2

The pattern you have configured does not match your data. The first field is not a pure IP address, but also seems to contain a port number, which you will need to account for. Have a look at this introductory blog post which shows you how to work with Logstash and develop grok patterns.


(Sripal) #3

@Christian_Dahlqvist Thank you for the reply. It's very useful to me. I'll let you know my status once done.


(Sripal) #4

@Christian_Dahlqvist Thank you soo much.
Now its working


(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.