Oniguruma patern will not work in grok debuger

Elastic Stack Logstash
1

I have a filters like that:

filter {
  grok {
      match => { "message" => '%{TIME:timestamp} (\[)?(%{DATA:logger})?(\])? \{%{DATA:thread}\} %{LOGLEVEL:level} : (?<problem>(.|\r|\n)*)' }
      remove_field => ["message"]
      }
  grok {
      match => { "problem" => ''(?<exception>java(.*)Exception).*\z" }
  }
}

And in regex101 it is working and group exception is what I wanted to achieve.

Sample of problem field:

Problem with cache (get from DB):\njava.lang.NullPointerException: null\n09:56:49.712 pl.com.agora.api.client.rest.invocation.FutureCallbacksSupport {HttpClient@2052321524-scheduler} ERROR : Uri invocation failure callback failed. Invocation : AbstractUriInvocation [successful=false

and so on.
Why it is still telling that exception is the same as problem instead of only: java.lang.NullPointerException

2

Hi
This pattern (?<exception>java(.*)Exception).*\z works as you expected on https://grokdebug.herokuapp.com/ with your problem field contents so I presume it may be due to syntax.

Is your grok filter a verbatim copy of the actual configuration?
Then, the repeated single quotes '' instead of double quotes " are wrong and it may be cause of this issue.

3

Thank you, but I'm still getting no match even at herokuapp :frowning:

4

I have checked again in grok debugger and it's working! :slight_smile:

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.