I am new to ELK and I'm having issues with Grok. I'm trying to parse logs that look similar to this:
"message" => "<188>362233: Jan 3 15:17:27: %IGMP_QUERIER-4-ZERO_SRC_IP_ADDR: An IGMP General Query packet with source IP address that contained all zeroes is received in VLAN 1 on port Gi2/0/52.",
This is from a Cisco switch. I would like to pull the <188> and 362233 as well as the date and time out of the message but I'm not sure how to do it. I tried Grok and I think I made it match (how can I confirm?) the <188> part using %BASE10NUM:syslog_pri filter but it was still in the message part even though it did make a new tag called syslog_pri.
Also, where can I find documentation on what the built in regex filters actually do? I'm not very good with regex so I need a little explanation (I did find the actual expressions on github).
Thank you for the help!