Iostat grok logstash

Hey, im trying to process logs from iostat, the problem is i have different machines with 1 or 2 disks, which means i have logs with different number of lines


Device:            tps    MB_read/s    MB_wrtn/s    MB_read    MB_wrtn
sda               0,00         0,00         0,00          0          0
sdb               1,00         0,00         0,01          0          0


Device:            tps    MB_read/s    MB_wrtn/s    MB_read    MB_wrtn
sda              50,00         0,00         0,53          0          0  

Im using the following logstash grok expression:


i put the 2nd line as optional but still it s not working properly, anyone have any idea how to do this?

Thank you in advance

Optional how? I don't see anything that makes %{WORD:device2:float}[\s]+%{fl:tps2:float}[\s]+%{fl:read2:float}[\s]+%{fl:write2:float}% optional.

Sorry, i forgot to put the ()?


Okay. How is it not working? Which kind of iostat output doesn't it work with?

grok pattern:


result in grokconstructor:

with this grok pattern it appends the sdb line to the previous greedydata from the line above

Try not using GREEDYDATA then.

So how do i match anything until the end of the line?

GREEDYDATA is working fine from header line to sda line


that's the fastest regex I can think of matching 1 or more any char except EOL

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.