Hi guys,
I am trying to pars a log file of ~500 lines to find the following two lines: flaked=yes && platform=aws so that I can add these lines as attributes for the given event/document.
The configuration (logstash.conf):
filter {
grok {
patterns_dir => ["/usr/local/src/logstash/pattern"]
match => { "message" => "%{FLAKED:flaked} %{PLATFORM:platform}" }
}
}
My pattern file:
FLAKED flaked\s*=\s*.?$
PLATFORM platform\s=\s*.*?$
The configuration above results in the following error:
"tags" : [
"multiline",
"_grokparsefailure"
]
The expressions are correct, it is working perfectly fine if I just use/call one of them. Do you guys know what the problem is and how to solve it?
Thanks!