Logstash - grokparsefailure

[hassen_k]

Hi,

Logstash version 7.16.2

I am trying to parse the following logs:

amAuthWindowsDesktopSSO:12/22/2021 03:55:44:349 PM CET: Thread[http-nio-8080-exec-3,5,main]: TransactionId[b742688f-6089-41c4-925d-ba08dce4d7b7-14913202]\nERROR: Authentication failed with PrivilegedActionException wrapped GSSException. Stack Trace\nGSSException:

I use the following patterns:

EPTZ (?:CEST|CET)
MILLISECONDS (\d){3,7}
MY_DATESTAMP %{MONTHNUM}/%{MONTHDAY}/20%{YEAR} %{HOUR}:%{MINUTE}:%{SECOND}:%{MILLISECONDS} (?:AM|am|PM|pm) %{EPTZ}
# my Pattern
%{GREEDYDATA:logtype}:%{MY_DATESTAMP:timestamp}: %{GREEDYDATA}\[%{GREEDYDATA:logthread}\]: %{GREEDYDATA}\[%{GREEDYDATA:logtransactionid}\]\\n%{LOGLEVEL:loglevel}: (?m)%{GREEDYDATA:logmessage}

I tested it in this website Test grok patterns and it works. But in Logstash, I get an error: _grokparsefailure

Any idea why?

Regards
H.

[Badger]

@hassen_k

\\n%{LOGLEVEL:loglevel}

I suspect you have an actual newline character there, so you want \n, not \\n.