I need to start a grok at <190>
I dont care about anything before that . What is the way to do this ?
<13>Nov 25 15:36:31 servername.abc.com LOGSTASH[-]: <190>Nov 25 07:36:31
Hello Brian,
Yo can use the grok debugger in Kibanas Dev Tools to test it: Grok patterns do not necessarily need to start at the beginning of the message. Something like this will work:
<190>%{MONTH:month} %{MONTHDAY:day} %{TIME:time}
Best regards
Wolfram
Are you 100% sure <190> will be the PRI header for 100% of the log events? Never <189>?
i ended up doing a %{GREEDYDATA:notneeded} %{SYSLOG5424PRI}
to start at <190>
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.