Matching/Finding keywords in an already parsed field via GROK

(Nadim Harb) #1

So i have an unstructured log, after applying a GROK filter, i was able to parse it into seperate fields.
The problem is that the last field which is {GREEDYDATA:Message} contains some keywords like "userID", "Failure" , "Established",... i would like to detect them.
Any suggestions ?


One approach would be to use

    grok {
        break_on_match => false
        match => {
            "message" => [

That will result in keyword being a string if there is one match, or an array if there is more than one. Unless the last pattern (userID) matches, there will be a _grokparsefailure.

(Nadim Harb) #3

@Badger thanks for the replay, yep it worked fine