Kibana Grok Debugger Multiple Custom Patterns

Elastic Stack Kibana
1

I am trying to add multiple custom grok patterns to the grok debugger in Kibana. I currently have this:

{"IIS_HOST" : "[a-zA-z.-]+"}

But every time I add another grok patter, I get a syntax error.
I am wondering if the debugger can only take one custom pattern at a time (which would be quite counter intuitive). I also more strongly believe that my syntax is just incorrect and needs sorting out.

If someone could give me some pointers as to how to correct my syntax that'd be great! I have looked online but can't seem to find anything, the documentation only guides me on how to add one custom grok pattern so isn't much help.

regards,

G

2

Are you using a percent sign before the bracket? Here's some more information on how to use the debugger:

https://www.elastic.co/guide/en/kibana/current/grokdebugger-getting-started.html

Can you give me an example of what you're inputting that gives you an error? Thanks!

3

Hi Lukas.
Currently all I am trying to do is to put more than one custom grok pattern in the debugger. But for the purpose of resolving this issue I will provide you with a screenshot of what I have so far.

image
image.png1166×458 11.6 KB

So as you can see above I have used a custom grok pattern to match the 'Host' section of the log. Below is what I would like to achieve, however I believe my syntax is incorrect in the 'Custom Grok Patterns' section.
image
image.png1171×476 13.1 KB

cheers,

G

4

Could you try this instead?

{
  "IIS_HOST" : "[a-zA-Z.-]+",
  "IIS_TIMESTAMP" : "INSERT REGEX HERE"
}
5

I typed out the below this morning and forgot to post it:

I resolved the issue, I messed about with my syntax a bit and this is what I've got working:
{"IIS_HOST" : "[a-zA-z.-]+" , "IIS_TIMESTAMP" : "01"}

Each custom grok needs to be enclosed in the curly brackets and each pattern is to be comma separated.
I would suggest this is added to the documentation as trying to guess syntax is extremely difficult to 'guess'.

Cheers,

G

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.