My grok parse error skip some value

Elastic Stack Logstash
1

i have problem to parse this value

My input is this:
2013-02-28 09:57:56,SERVICEID|0863591797|topup|C00000001||10.0|20170110|N|aaa|bbb|ccc|aaaaabbb|ccccc|kkkkk|hhhhh

My grok filter is this:
^%{TIMESTAMP_ISO8601:timestamp},%{WORD:SERVICE}|%{WORD:MSISDN}|%{WORD:RULEID}|%{WORD:CAMPCODE}|(?:.*|%{WORD:CURRENT})|(?(?:%{BASE10NUM}))|%{WORD:EVNETDTTM}

after parsing some value 20170110 have to skipping. need to help fix my grok please.

24
241093×251 8.73 KB

2

It's hard to understand what you're asking. It seems your grok expression is working correctly. What's the desired result?

3

It' look like work but it not work because value in EVNETDTTM equal "N" is wrong. Correct value is "20170110".

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.