Logstash grok filter for quoted value OR dash

Elastic Stack Logstash
1

Hello,
I have a blue coat Proxy log that have a field that can either be a quouted value like "Microsoft-CryptoAPI/15.2" or a dash (-).

I captured this with %{QUOTEDSTRING:useragent} Before i found out that the value can be a dash (-)
Then the filter breaks

Any ideas from the Community?

2

Think i solved it, replaced %{QUOTEDSTRING:useragent} with (?<useragent>(\".*\")|-)

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.