Need help for regular expresion

Elastic Stack Logstash
#1

I have the following either of the Pattern in my log messages
ABC[]
ABC[User(UserID)]
ABC[User(UserID) Sponser(SponserName)]

UserID and SponserName are Alphanumeric, Ex:
[User(ABCDE12345) Sponser(Test Sponser)]

Please help me on regular expresion, I have tried with http://grokdebug.herokuapp.com/ but not able to get correct expression.

#2

The grok filter accepts multiple pattern, which are tried in order, so you could list these in order:

%{WORD:whatever}\[\]
%{WORD:whatever}\[User\(%{WORD:user}\)\]
%{WORD:whatever}\[User\(%{WORD:user}\) Sponsor\(%{WORD:sponsor}\)\]

This might be less CPU-intensive but is harder on the eyes:

%{WORD:whatever}\[(User\(%{WORD:user}\)( Sponsor\(%{WORD:sponsor}\))?)?\]
#3

Hi Mangnus,

I am using the the second one i.e Less CPU intensive regular expression
%{WORD:whatever}\[(User\(%{WORD:user}\)%{SPACE}(Sponsor\(%{WORD:sponsor}\))?)?\]

it parsing only
ABC[]
ABC[User(UserID)]

its failing to parse with above mentioned regEx
ABC[User(UserID) Sponser(SponserName)]

you are adding ? after the brace () it means it remove that brace?

Please help me

#4

its failing to parse with above mentioned regEx
ABC[User(UserID) Sponser(SponserName)]

The expression says "Sponsor" but you're trying with "Sponser".

you are adding ? after the brace () it means it remove that brace?

No, it means that the preceding token (in this case the whole parenthesized sub expression) is optional, i.e. can occur zero or one times.

#5