# Iostat grok logstash

**URL:** <https://discuss.elastic.co/t/iostat-grok-logstash/70424>\
**Category:** Logstash\
**Created:** [January 3, 2017, 11:53am UTC](https://discuss.elastic.co/t/iostat-grok-logstash/70424 "2017-01-03T11:53:52Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pedro\_Vilas-Boas](https://avatars.discourse-cdn.com/v4/letter/p/bc79bd/32.png) [@Pedro\_Vilas-Boas](https://discuss.elastic.co/u/Pedro_Vilas-Boas)\
**Post date:** [January 3, 2017, 11:53am UTC](https://discuss.elastic.co/t/iostat-grok-logstash/70424/1 "2017-01-03T11:53:52Z")

</div>

Hey, im trying to process logs from iostat, the problem is i have different machines with 1 or 2 disks, which means i have logs with different number of lines

Example:

```
2017-01-03T10:41:35+0000
Device: tps MB_read/s MB_wrtn/s MB_read MB_wrtn
sda 0,00 0,00 0,00 0 0
sdb 1,00 0,00 0,01 0 0

```

and

```
2017-01-03T10:37:43+0000
Device: tps MB_read/s MB_wrtn/s MB_read MB_wrtn
sda 50,00 0,00 0,53 0 0  

```

Im using the following logstash grok expression:

`%{TIMESTAMP_ISO8601:time5}\n%{GREEDYDATA}\n%{WORD:device1}[\s]+%{fl:tps1:float}[\s]+%{fl:read1:float}[\s]+%{fl:write1:float}%{GREEDYDATA}(\n%{WORD:device2:float}[\s]+%{fl:tps2:float}[\s]+%{fl:read2:float}[\s]+%{fl:write2:float}%{GREEDYDATA})?`

i put the 2nd line as optional but still it s not working properly, anyone have any idea how to do this?

Thank you in advance

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 3, 2017, 12:27pm UTC](https://discuss.elastic.co/t/iostat-grok-logstash/70424/2 "2017-01-03T12:27:00Z")

</div>

Optional how? I don't see anything that makes `%{WORD:device2:float}[\s]+%{fl:tps2:float}[\s]+%{fl:read2:float}[\s]+%{fl:write2:float}%` optional.

---

<div class="post-metadata">

**Author:** ![Pedro\_Vilas-Boas](https://avatars.discourse-cdn.com/v4/letter/p/bc79bd/32.png) [@Pedro\_Vilas-Boas](https://discuss.elastic.co/u/Pedro_Vilas-Boas)\
**Post date:** [January 3, 2017, 12:58pm UTC](https://discuss.elastic.co/t/iostat-grok-logstash/70424/3 "2017-01-03T12:58:43Z")

</div>

> [@Pedro\_Vilas-Boas](#):
>
> \n%{WORD:device2:float}[\s]+%{fl:tps2:float}[\s]+%{fl:read2:float}[\s]+%{fl:write2:float}%{GREEDYDATA}

Sorry, i forgot to put the ()?

`(\n%{WORD:device2:float}[\s]+%{fl:tps2:float}[\s]+%{fl:read2:float}[\s]+%{fl:write2:float}%{GREEDYDATA})?`

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 3, 2017, 1:54pm UTC](https://discuss.elastic.co/t/iostat-grok-logstash/70424/4 "2017-01-03T13:54:40Z")

</div>

Okay. How is it not working? Which kind of iostat output doesn't it work with?

---

<div class="post-metadata">

**Author:** ![Pedro\_Vilas-Boas](https://avatars.discourse-cdn.com/v4/letter/p/bc79bd/32.png) [@Pedro\_Vilas-Boas](https://discuss.elastic.co/u/Pedro_Vilas-Boas)\
**Post date:** [January 3, 2017, 1:57pm UTC](https://discuss.elastic.co/t/iostat-grok-logstash/70424/5 "2017-01-03T13:57:35Z")

</div>

grok pattern:

```
(?m)%{TIMESTAMP_ISO8601:time5}%{GREEDYDATA:header}sda[\s]+%{fl:tps1:float}[\s]+%{fl:read1:float}[\s]+%{fl:write1:float}%{GREEDYDATA:linha1}\n(sdb[\s]+%{fl:tps2:float}[\s]+%{fl:read2:float}[\s]+%{fl:write2:float}%{GREEDYDATA:linha2})?

```

result in grokconstructor:

 ![](https://us1.discourse-cdn.com/elastic/original/2X/f/fec1d371d5a2f08d936010c23f0689734822fdcc.png)

with this grok pattern it appends the sdb line to the previous greedydata from the line above

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 3, 2017, 2:02pm UTC](https://discuss.elastic.co/t/iostat-grok-logstash/70424/6 "2017-01-03T14:02:08Z")

</div>

Try not using GREEDYDATA then.

---

<div class="post-metadata">

**Author:** ![Pedro\_Vilas-Boas](https://avatars.discourse-cdn.com/v4/letter/p/bc79bd/32.png) [@Pedro\_Vilas-Boas](https://discuss.elastic.co/u/Pedro_Vilas-Boas)\
**Post date:** [January 3, 2017, 2:03pm UTC](https://discuss.elastic.co/t/iostat-grok-logstash/70424/7 "2017-01-03T14:03:20Z")

</div>

So how do i match anything until the end of the line?

GREEDYDATA is working fine from header line to sda line

---

<div class="post-metadata">

**Author:** ![nellicus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nellicus/32/51566_2.png) [@nellicus](https://discuss.elastic.co/u/nellicus)\
**Post date:** [January 3, 2017, 2:09pm UTC](https://discuss.elastic.co/t/iostat-grok-logstash/70424/8 "2017-01-03T14:09:41Z")

</div>

```
[^$]+

```

that's the fastest regex I can think of matching 1 or more any char except EOL

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 31, 2017, 2:09pm UTC](https://discuss.elastic.co/t/iostat-grok-logstash/70424/9 "2017-01-31T14:09:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.