I Need help with grok, stuck with grokparsefailure

My input file:

k10temp-pci-00c3
temp1:        +47.8°C  (high = +70.0°C)
temp1:        +48.0°C  (crit = +255.0°C)
temp1:        +47.0°C  (crit = +120.0°C, hyst = +90.0°C)
k10temp-pci-00c3
Adapter: PCI adapter
temp1:        +47.8°C  (high = +70.0°C)
                       (crit = +100.0°C, hyst = +99.0°C)

acpitz-virtual-0
Adapter: Virtual device
temp1:        +48.0°C  (crit = +255.0°C)

radeon-pci-0008
Adapter: PCI adapter
temp1:        +47.0°C  (crit = +120.0°C, hyst = +90.0°C)![Screenshot%20from%202018-08-16%2015-38-09|690x388](upload://eEKM534MRFdgI8uHNMET0w3rE0S.png) 

/dev/sda: HGST HTS541075A9E680: 39°C
k10temp-pci-00c3
temp1:        +47.2°C  (high = +70.0°C)
temp1:        +48.0°C  (crit = +255.0°C)
temp1:        +47.0°C  (crit = +120.0°C, hyst = +90.0°C)
k10temp-pci-00c3
Adapter: PCI adapter
temp1:        +47.0°C  (crit = +120.0°C, hyst = +90.0°C) />

input:

input {
        #udp{
        #port => 25826
        #buffer_size => 1452
        #codec => collectd{}
#)
        file { path => ["/var/log/Temperatures.log"]


}    }

filter

filter {



      # if "_grokparsefailure" in [tags]{
        #drop { }


        grok {
                match => { "message" => [ "%{GREEDYDATA:Name_PCI}\n%{GREEDYDATA:temp0}\n%{GREEDYDATA:temp1}\n%{GREEDYDATA:temp2}\n%{GREEDYDATA:Name_PCI1}\n%{GREEDYDATA:Name_PCI2}\n%{GREEDYDATA:temp00}\n%{GREEDYDATA:crit}\n\n%{GREEDYDATA:Name_1}\n%{GREEDYDATA:Name_2}\n%{GREEDYDATA:temp000}\n\n%{GREEDYDATA:Name_3}\n%{GREEDYDATA:Name_4}\n%{GREEDYDATA:temp01}\n\n%{GREEDYDATA:Name_HDD}\n%{GREEDYDATA:Name_4}\n%{GREEDYDATA:temp0000}\n%{GREEDYDATA:temp000000}\n%{GREEDYDATA:temp0000000}\n%{GREEDYDATA:Name_PCI3}\n%{GREEDYDATA:Name_PCI4}\n%{GREEDYDATA:temp001}"] }
                                }



        #}

}

On Grok debbuger (https://grokdebug.herokuapp.com/) it show everything but running it through logstash getting grokparsefailure. Only 1 configfile (see above) in conf.d.
!


Need help been trying for days with no luck. i know i am missing something but can't figure it out
Thanks in advance

A file input will consume a file creating one event for each line of the file. You are trying to match multiple lines in a single pattern. That's not going to work. You may want to use a multiline codec on the input, depending on what you are trying to do.

Do you have an example for me (still learning)
(thank for the reply)

Im trying to get all the temperatures from my devices with name and all

The pattern is unclear, but this might work

codec => multiline { pattern => "^[0-9a-z]+-[0-9a-z]+-[0-9a-z]+$" negate => true what => "previous" auto_flush_interval => 2 }

i don't understand the pattern,

input {
        #udp{
        #port => 25826
        #buffer_size => 1452
        #codec => collectd{}
#)
        file { path => ["/var/log/Temperatures.log"]
                codec => multiline {
                        pattern => "^[0-9a-z]+-[0-9a-z]+-[0-9a-z]+$"
                        negate => true
                         what => "previous"
                         auto_flush_interval => 2}
    }


}

filter {

  # if "_grokparsefailure" in [tags]{
    #drop { }


    grok {
            match => { "message" => [ "%{GREEDYDATA:Name_PCI}", "%{GREEDYDATA:temp0}", "%{GREEDYDATA:temp1}", "%{GREEDYDATA:temp2}", "%{GREEDYDATA:Name_PCI1}", "%{GREEDYDATA:Name_PCI2}", "%{GREEDYDATA:temp00}", "%{GREEDYDATA:crit}", "%{GREEDYDATA:Name_1}", "%{GREEDYDATA:Name_2}", "%{GREEDYDATA:temp000}", "%{GREEDYDATA:Name_3}", "%{GREEDYDATA:Name_4}", "%{GREEDYDATA:temp01}", "%{GREEDYDATA:Name_HDD}", "%{GREEDYDATA:Name_4}", "%{GREEDYDATA:temp0000}", "%{GREEDYDATA:temp000000}", "%{GREEDYDATA:temp0000000}", "%{GREEDYDATA:Name_PCI3}", "%{GREEDYDATA:Name_PCI4}", "%{GREEDYDATA:temp001}"] }
                            }



    #}

}

Only the first get displayed from grok and multiline has an error i think

Screenshot%20from%202018-08-17%2014-02-33

But there is progress

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.