Hi there all, i started with Logstash the other day and currently getting to know the tool. I have a situation here. Consider the below Baraccuda FW log entry 2018 01 30 13:12:21 Security +01:00 Block: type=FWD|proto=UDP|srcIF=eth0|srcIP=10.17.34.12|srcPort=54915|srcMAC=18:db:f2:13:ca:9c|dstIP=10…

Personally I would approach a log like this using dissect { mapping => { "message" => "%{[@metadata][ts]} %{+[@metadata][ts]} %{+[@metadata][ts]} %{+[@metadata][ts]} %{word1} %{word2} %{word3} %{[@metadata][restOfLine]}" } } date { match => [ "[@metadata][ts]", "YYYY MM dd HH:mm:ss" ] } …

Discuss the Elastic Stack

Is positive lookbehind supported in Logstash at all?

Elastic Stack Logstash

Badger March 17, 2021, 3:38pm 4

I never use anything other than grok to develop grok patterns because the online grok debugger and even kibana can interpret patterns differently to grok. See here for more detail.

1 Like

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.