Logstash help with pattern for grok needed

Elastic Stack Logstash
1

Hello, I am trying to parse some data which is in one of the two following formats:

Sample data:

Data from service service-a loaded
Data from service service-b not loaded

With the following Grok Pattern:

Data from service %{NOTSPACE:service} %{NOT:n}loaded

and custom patterns:

NOT (?:not )

I work in Kibana > Grok Debugger. It seems that my pattern matches the second line of sample data but not the first. I am trying to make it so that the "not " part is optional, and to generate a pattern which matches all my inputs. Could you help me?

Second question, is it possible to use grok to output an integer value, 0 or 1, depending on whether the data from the service is loaded or not?

2

That is, I believe, a non-capturing field. If you want an optional field then the ? should be at the end

(not )?
1 Like
3

Thank you, that works. Would someone have an idea for the second question as well?

4

The field [n] will only exist if the service is not loaded, so you could use

if [n] {
    mutate { add_field => { "someField" => 0 } }
} else {
    mutate { add_field => { "someField" => 1 } }
}
mutate { convert => { "someField" => "integer" } }
1 Like
5

thanks!

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.