Matching/Finding keywords in an already parsed field via GROK

Elastic Stack Logstash
1

Hello,
So i have an unstructured log, after applying a GROK filter, i was able to parse it into seperate fields.
The problem is that the last field which is {GREEDYDATA:Message} contains some keywords like "userID", "Failure" , "Established",... i would like to detect them.
Any suggestions ?

2

One approach would be to use

    grok {
        break_on_match => false
        match => {
            "message" => [
             "(^|\W)(?<keyword>Established)(\W|$)",
             "(^|\W)(?<keyword>Failure)(\W|$)",
             "(^|\W)(?<keyword>userID)(\W|$)"
            ]
        }
    }

That will result in keyword being a string if there is one match, or an array if there is more than one. Unless the last pattern (userID) matches, there will be a _grokparsefailure.

1 Like
3

@Badger thanks for the replay, yep it worked fine

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.