LogStash Config File - Grok Regex

Hello Community,

I'm very new to LogStash and I have a question. I am trying to use grok to get a substring from my message and put it in a new field. I've used grokdebugger in kibana and it seems to highlight the right text.
This is my grok pattern: (?<CR Number>(?<=CR num:)".{0,20}?")

What is the right way to put this grok pattern in config file? I am expecting it to create a new CR Number field. Right now I am doing this, but it does not work:

if [type] == "esign" 
    grok {
      match => { "message" => "(?<CR Number>(?<=CR num:)".{0,20}?")" }

Am I putting the grok regex pattern in config file the right way?
Thanks in advance!

Karanbir Mann

I would expect logstash to log an error for that. If you have double quotes in your pattern then use single quotes around it

'(?<CR Number>(?<=CR num:)".{0,20}?")'

Hi @Badger,

Amazing suggestion. I actually just solved my issue by escaping my double quotes using backslash and it solved the issue.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.