Logstash: grok pars failure with multiple custom patterns

Elastic Stack Logstash
1

Hi guys,

I am trying to pars a log file of ~500 lines to find the following two lines: flaked=yes && platform=aws so that I can add these lines as attributes for the given event/document.
The configuration (logstash.conf):

filter {
  grok {
    patterns_dir => ["/usr/local/src/logstash/pattern"]
    match => { "message" => "%{FLAKED:flaked} %{PLATFORM:platform}" }
    }
  }

My pattern file:
FLAKED flaked\s*=\s*.?$
PLATFORM platform\s=\s*.*?$

The configuration above results in the following error:
"tags" : [
"multiline",
"_grokparsefailure"
]

The expressions are correct, it is working perfectly fine if I just use/call one of them. Do you guys know what the problem is and how to solve it?

Thanks!

2

Use a stdout { codec => rubydebug } output to show us exactly what the event you want to match look like.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.