Logstash grok regex bug?

Elastic Stack Logstash
1

Logstash grok regex match result is not same with Kibana Grok Debugger.
(I think Kibana Grok Debugger's result is correct.)

Is there my fault? or is it grok's bug?

Filebeat Config

filebeat.inputs:
- type: log
  paths:
    - C:/filebeat/smtp.log
  multiline.pattern: 'SMTP Server: Originator'
  multiline.negate: true
  multiline.match: after
  multiline.flush_pattern: 'SMTP Server: Message'

Logstash Config

filter {
    grok {
        match => {
            "message" => "\[.*\] (?<timestamp>\d{4}-\d{2}-\d{2} (?:AM|PM) \d{2}:\d{2}:\d{2})  SMTP Server: Originator: (?<sender>.*?)\n(?<temp_receiver>(?:.*SMTP Server: Recipient: .*\n)+)(?:.*\n)*(?:.*SMTP Server: Message.*size (?<size>.*))"
        }
    }
}

Logstash Debug Output

output
output960×480 8.92 KB

Kibana Grok Debugger Result

debugger
debugger1493×637 40.2 KB

How can I get a same result with kibana grok debugger in logstash grok?
plz, help me~

2

Please do not post pictures of text, just post the text.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.