Matching/Finding keywords in an already parsed field via GROK


So i have an unstructured log, after applying a GROK filter, i was able to parse it into seperate fields.
The problem is that the last field which is {GREEDYDATA:Message} contains some keywords like "userID", "Failure" , "Established",... i would like to detect them.
Any suggestions ?


One approach would be to use

    grok {
        break_on_match => false
        match => {
            "message" => [

That will result in keyword being a string if there is one match, or an array if there is more than one. Unless the last pattern (userID) matches, there will be a _grokparsefailure.

1 Like

@Badger thanks for the replay, yep it worked fine

(system) closed #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.