My grok parse error skip some value

i have problem to parse this value

My input is this:
2013-02-28 09:57:56,SERVICEID|0863591797|topup|C00000001||10.0|20170110|N|aaa|bbb|ccc|aaaaabbb|ccccc|kkkkk|hhhhh

My grok filter is this:
^%{TIMESTAMP_ISO8601:timestamp},%{WORD:SERVICE}|%{WORD:MSISDN}|%{WORD:RULEID}|%{WORD:CAMPCODE}|(?:.*|%{WORD:CURRENT})|(?(?:%{BASE10NUM}))|%{WORD:EVNETDTTM}

after parsing some value 20170110 have to skipping. need to help fix my grok please.

It's hard to understand what you're asking. It seems your grok expression is working correctly. What's the desired result?

It' look like work but it not work because value in EVNETDTTM equal "N" is wrong. Correct value is "20170110".

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.