Hi there all, i started with Logstash the other day and currently getting to know the tool. I have a situation here. Consider the below Baraccuda FW log entry 2018 01 30 13:12:21 Security +01:00 Block: type=FWD|proto=UDP|srcIF=eth0|srcIP=10.17.34.12|srcPort=54915|srcMAC=18:db:f2:13:ca:9c|dstIP=10…

Personally I would approach a log like this using dissect { mapping => { "message" => "%{[@metadata][ts]} %{+[@metadata][ts]} %{+[@metadata][ts]} %{+[@metadata][ts]} %{word1} %{word2} %{word3} %{[@metadata][restOfLine]}" } } date { match => [ "[@metadata][ts]", "YYYY MM dd HH:mm:ss" ] } …

Discuss the Elastic Stack

Is positive lookbehind supported in Logstash at all?

Elastic Stack Logstash

Badger March 17, 2021, 3:38pm 4

I never use anything other than grok to develop grok patterns because the online grok debugger and even kibana can interpret patterns differently to grok. See here for more detail.

1 Like

Topic		Replies	Views
Grok - Positive Lookbehind Logstash	2	2051	November 6, 2017
Negative look behind not working Logstash	1	786	December 26, 2016
Grokdebugger works but not with logstash Logstash	3	808	July 6, 2017
Logstash skipping some lines Logstash	1	857	July 6, 2017
Logstash grok vs. grok debugger Logstash	8	1763	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Is positive lookbehind supported in Logstash at all?

Related topics