Logstash Null Value

Elastic Stack Logstash
1

I want to display null value from the below log in Kibana.
"Roles changed for user 'AIPTEST\geetanjali.j.podal' from "" to "ContentAdmin""

I can able to capture at 'https://grokdebug.herokuapp.com/' by using below Patterns and not able to capture through logstash config and Kibana as well.

"(?<role_type>\b\w+\b\s\b\w+\b) for user '%{WORD:domain}\%{USERNAME:role_changed_for}' from \"(?<role_from>.*)\" to \"(?<role_to>.*)\"\t%{USERNAME:id6}"

Result looks like this when i debug at 'https://grokdebug.herokuapp.com/'
"role_from": [
[
""
]
],
"role_to": [
[
"ContentAdmin"
]indent preformatted text by 4 spaces

2

Please format your regular expression as code so it doesn't get mangled.

3

Hi Magnus,

Thanks for your response, i am not clear about what your referring, you mean custom pattern?

If custom pattern please help me in doing.

4

Your regular expression has (most likely) been screwed up when you posted here since sequences like <whatever> are replaced with an empty string. Please edit your post, select the regular expression, and click the </> button in the toolbar. I don't want to guess what your regular expression looks like.

5

I did, as you mentioned

6

You didn't format the whole expression as code so I still had to hand edit it to get it to work.

This works with the example input that you provided:

filter {
  grok {
    match => ["message", "(?<what>\b\w+\b\s\b\w+\b) for user '%{WORD:domain}\\%{USERNAME:role_changed_for}' from \"(?<role_from>.*)\" to \"(?<role_to>.*)\""]
    keep_empty_captures => true
  }
}

The keep_empty_captures option is the key.