Logstash: grok pars failure with multiple custom patterns

(Erik) #1

Hi guys,

I am trying to pars a log file of ~500 lines to find the following two lines: flaked=yes && platform=aws so that I can add these lines as attributes for the given event/document.
The configuration (logstash.conf):

filter {
  grok {
    patterns_dir => ["/usr/local/src/logstash/pattern"]
    match => { "message" => "%{FLAKED:flaked} %{PLATFORM:platform}" }

My pattern file:
FLAKED flaked\s*=\s*.?$
PLATFORM platform\s

The configuration above results in the following error:
"tags" : [

The expressions are correct, it is working perfectly fine if I just use/call one of them. Do you guys know what the problem is and how to solve it?


(Magnus B├Ąck) #2

Use a stdout { codec => rubydebug } output to show us exactly what the event you want to match look like.

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.