Logstash: grok pars failure with multiple custom patterns

Hi guys,

I am trying to pars a log file of ~500 lines to find the following two lines: flaked=yes && platform=aws so that I can add these lines as attributes for the given event/document.
The configuration (logstash.conf):

filter {
  grok {
    patterns_dir => ["/usr/local/src/logstash/pattern"]
    match => { "message" => "%{FLAKED:flaked} %{PLATFORM:platform}" }
    }
  }

My pattern file:
FLAKED flaked\s*=\s*.?$
PLATFORM platform\s
=\s*.*?$

The configuration above results in the following error:
"tags" : [
"multiline",
"_grokparsefailure"
]

The expressions are correct, it is working perfectly fine if I just use/call one of them. Do you guys know what the problem is and how to solve it?

Thanks!

Use a stdout { codec => rubydebug } output to show us exactly what the event you want to match look like.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.