Logstash grok pattern: Unexpected output

[rahulnama]

Hello,

This is the sample log pattern I'm parsing. I'm using grok but it's not exactly as what I expected

180528 8:46:26 2 Query SELECT 1

To parse this log my grok pattern is

%{NUMBER:date} %{NOTSPACE:time}%{INT:pid}%{GREEDYDATA:message}

and output for this in grok debugger is

{
  "date": [
    [
      "180528"
    ]
  ],
  "time": [
    [
      "8:46:2"
    ]
  ],
  "pid": [
    [
      "6"
    ]
  ],
  "message": [
    [
      " 2 Query\tSELECT 1"
    ]
  ]
}

If you observe in the output, pid is being extracted from time and actual pid which is 2 is being merged in the message. Not sure what went wrong here

Please help, Thanks for your time

[magnusbaeck (Magnus Bäck)]

You need spaces between your NOTSPACE, INT, and GREEDYDATA patterns.

[rahulnama]

@magnusbaeck

Still I'm not able to make it

Any suggestions?

[magnusbaeck (Magnus Bäck)]

There are two spaces between the timestamp and "2 Query". You can use \s+ to match one or more whitespace characters.

[rahulnama]

It worked

Thankyou much @magnusbaeck