Logstash grok filter ignoring white space delimiter


I am using Logstash GA 5.0.0 with Kafka. I am ading a custom parameter "logtype":"mylogs" in kafka input. I have a Kafka message like;

##SEVERE 05-Jan-2017 06:02:25.562 com.memberA.studentB.classCa startup CUSTOM_FOUR::printf():::AA##

and in Logstash grok, i use filter like;

match => { "message" => "^##(?<severity>(SEVERE|INFO|WARN)) (?<timestamp>%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME}) %{GREEDYDATA:className} %{GREEDYDATA:msg2}" }

but my Logstash output is like below;

	"className":"com.memberA.studentB.classCa startup",
	"message":"##SEVERE 05-Jan-2017 06:02:25.562 com.memberA.studentB.classCa startup CUSTOM_FOUR::printf():::AA##",
	"timestamp":"05-Jan-2017 06:02:25.562"

The tag className is suppose to be like com.memberA.studentB.classCa, but it slike com.memberA.studentB.classCa startup now. The term startup is coming along with it. How can I fix this?


As you just want the className pattern to capture up until the first space, try replacing GREEDYDATA:className with NOTSPACE:className.

It works! Thank you so much @Christian_Dahlqvist :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.