Logstash grok pattern: Unexpected output


This is the sample log pattern I'm parsing. I'm using grok but it's not exactly as what I expected

180528 8:46:26 2 Query SELECT 1

To parse this log my grok pattern is

%{NUMBER:date} %{NOTSPACE:time}%{INT:pid}%{GREEDYDATA:message}

and output for this in grok debugger is

  "date": [
  "time": [
  "pid": [
  "message": [
      " 2 Query\tSELECT 1"

If you observe in the output, pid is being extracted from time and actual pid which is 2 is being merged in the message. Not sure what went wrong here

Please help, Thanks for your time

You need spaces between your NOTSPACE, INT, and GREEDYDATA patterns.


Still I'm not able to make it

Any suggestions?

There are two spaces between the timestamp and "2 Query". You can use \s+ to match one or more whitespace characters.

1 Like

It worked :slight_smile:

Thankyou much @magnusbaeck

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.