Multiple patterns in grok filter

Hi,

I have written following grok filter to match multiple log formats.

filter {
grok {
match => {
"message" => "%{MONTH:Month}%{SPACE}%{NUMBER:Day} %{TIME:Time} %{IP:Host} %{NUMBER:SEQ_NO}: %{DATA:Month_From_Device}%{SPACE}%{NUMBER:Day_From_Device} %{TIME:Time_From_Device}: %%{DATA:Facility}-%{DATA:Severity}-%{DATA:Event}: Login Success [user: %{NUMBER:Service_Number}] [Source: %{IP:Log_in_Source}] %{GREEDYDATA:Information}","%{MONTH:Month}%{SPACE}%{NUMBER:Day} %{TIME:Time} %{IP:Host} %{NUMBER:SEQ_NO}: %{DATA:Month_From_Device}%{SPACE}%{NUMBER:Day_From_Device} %{TIME:Time_From_Device}: %%{DATA:Facility}-%{DATA:Severity}-%{DATA:Event}: Login failed [user: %{NUMBER:Service_Number}] [Source: %{IP:Log_in_Source}] %{GREEDYDATA:Information}", "%{MONTH:Month}%{SPACE}%{NUMBER:Day} %{TIME:Time} %{IP:Host} %{NUMBER:SEQ_NO}: %{DATA:Month_From_Device}%{SPACE}%{NUMBER:Day_From_Device} %{TIME:Time_From_Device}: %%{DATA:Facility}-%{DATA:Severity}-%{DATA:Event}: %{GREEDYDATA:Information}", "%{MONTH:Month}%{SPACE}%{NUMBER:Day} %{TIME:Time} %{IP:Host} %{NUMBER:SEQ_NO}: %{GREEDYDATA:Information}"
}
}
}

but it gives following error when testing config.

[FATAL] 2018-10-19 11:05:10.035 [LogStash::Runner] runner - The given configuration is invalid. Reason: Expected one of #, {, } at line 12, column 335 (byte 460) after filter {.....

Please help to resolve this matter.

thanks in advance

You need to specify the list of grok patterns within square brackets. There is an example in the documentation on how to do this.

I change the filter as below. but error is coming yet.

filter {
grok {
match => {
"message" => "[%{MONTH:Month}%{SPACE}%{NUMBER:Day} %{TIME:Time} %{IP:Host} %{NUMBER:SEQ_NO}: %{DATA:Month_From_Device}%{SPACE}%{NUMBER:Day_From_Device} %{TIME:Time_From_Device}: %%{DATA:Facility}-%{DATA:Severity}-%{DATA:Event}: Login Success [user: %{NUMBER:Service_Number}] [Source: %{IP:Log_in_Source}] %{GREEDYDATA:Information}"], "%{MONTH:Month}%{SPACE}%{NUMBER:Day} %{TIME:Time} %{IP:Host} %{NUMBER:SEQ_NO}: %{DATA:Month_From_Device}%{SPACE}%{NUMBER:Day_From_Device} %{TIME:Time_From_Device}: %%{DATA:Facility}-%{DATA:Severity}-%{DATA:Event}: Login failed [user: %{NUMBER:Service_Number}] [Source: %{IP:Log_in_Source}] %{GREEDYDATA:Information}", "%{MONTH:Month}%{SPACE}%{NUMBER:Day} %{TIME:Time} %{IP:Host} %{NUMBER:SEQ_NO}: %{DATA:Month_From_Device}%{SPACE}%{NUMBER:Day_From_Device} %{TIME:Time_From_Device}: %%{DATA:Facility}-%{DATA:Severity}-%{DATA:Event}: %{GREEDYDATA:Information}", "%{MONTH:Month}%{SPACE}%{NUMBER:Day} %{TIME:Time} %{IP:Host} %{NUMBER:SEQ_NO}: %{GREEDYDATA:Information}"
}
}
}

That does not match the example from the docs, does it?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.