So I'm using GROK to clean up some log files into Kibana but there's a couple areas im struggling with. How can get the value of to a field?:
X-FORWARDED-FOR -> (ip address)
timestampHere uidHere IPhere anotherIP X X X x / - - 0 0 - - - - - (empty) - - X-FORWARDED-FOR -> ipHere - - - - - - -
Sorry I have to kind of censor the data I'm working with.
So each entry belongs to a field. My specific problem is getting the X-FORWARDED-FOR -> ipHere all to a single field because the space. If I use greedydata i get that plus all the hyphens which are for other fields that i do not want.
I get the feeling you are trying to match the whole line, but there is no need to do that. There are no implicit anchors in grok. If the [message] field of your event contains
blah blah blah X-FORWARDED-FOR -> 127.3.6.9 more stuff
Huh I didn't know you could do it like that. I've been using this format and couldn't find a way to do it in terms of this way.
%{NUMBER:ts}%{SPACE}%{WORD:uid}%{SPACE}%{IP:orig_h}%{SPACE}%{NUMBER:orig_p}%{SPACE}%{IP:resp_h}
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.