Logstash Grok

Elastic Stack Logstash
1

I need to start a grok at <190>
I dont care about anything before that . What is the way to do this ?

<13>Nov 25 15:36:31 servername.abc.com LOGSTASH[-]: <190>Nov 25 07:36:31

2

Hello Brian,

Yo can use the grok debugger in Kibanas Dev Tools to test it: Grok patterns do not necessarily need to start at the beginning of the message. Something like this will work:
<190>%{MONTH:month} %{MONTHDAY:day} %{TIME:time}

Best regards
Wolfram

3

Are you 100% sure <190> will be the PRI header for 100% of the log events? Never <189>?

4

i ended up doing a %{GREEDYDATA:notneeded} %{SYSLOG5424PRI}

to start at <190>

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.