Hi All, i have the following log pattern
[20/Sep/2018:16:20:49 -0400] 00.000.000.000 "GET /XXXXX-XXXXX-XXXX/health HTTP/1.1" 200 (1 ms) 0
I am using the following grok pattern
@parse
@type grok
[%{DATA:time}] %{IPV4:ipAddress} %{GREEDYDATA:syslog_message}"%{SPACE}%{GREEDYDATA:httpStatus:integer}(
But I am left with a trailing space for http status
"httpStatus": [
[
"200 "
]
]
Can someone please help