Logstash grok filter for quoted value OR dash


(Micke) #1

Hello,
I have a blue coat Proxy log that have a field that can either be a quouted value like "Microsoft-CryptoAPI/15.2" or a dash (-).

I captured this with %{QUOTEDSTRING:useragent} Before i found out that the value can be a dash (-)
Then the filter breaks

Any ideas from the Community?


(Micke) #2

Think i solved it, replaced %{QUOTEDSTRING:useragent} with (?<useragent>(\".*\")|-)


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.