Log event with multi-line

(ssh) #1

hi there,

may i ask about multi-line pattern matching in grok filter.
in input part, i use tcp input plugin then grok in filter part.


2018-02-02 15:44:44,805 (null) 19 WARN : WEBFRORM: Somepage:: 342juajpobzxv4svu4jgt40v :: REQ: <PPRequest>
PPRequest: 27925660ms

when i grok this log event, i face _grokparsefailure
is there anyway to grok multi-line log event?

help! :smiley:

(Magnus Bäck) #2

Unless we know what your grok expression looks like we can't help.

(ssh) #3

this is my grok regex @magnusbaeck

if "<PPRequest>" in [message] {			
   grok {
		match => { "message" => [ "^(?<log_timestamp>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2},\d{1,3}).*?(?<threadno>\d+).*?%{WORD:log_level}.*?Somepage\s{0,}::\s+(?<session_id>.*?)\s{0,}::\s{0,}:REQ:.*?<iiid>(?<mid>.*?)</iiid>.*?<inv>(?<invoice_id>.*?)</inv>"]}
		add_field => { "log_type" => "PREQUEST" }

(Magnus Bäck) #4

Try prepending your expression with (?m). See example at https://stackoverflow.com/a/28231905/414355.

(ssh) #5

By using (?m) flag is only ok at https://grokdebug.herokuapp.com/
But when i use actual logstash conf, it doesn't work.

(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.