Optional text + field RegEx with filters in Logstash

Elastic Stack Logstash
1

Hello!

how can i set a text I use as locator as optioanal with regular expresions or grok ??

For example :

2021-12-15 13:50:34,589 INFO  Parámetros enviados a XXXXXX:
	accion : YYYYYYYYYYY
	mesNacimiento : YYYYYYYYYYYYYYYYY
	ape2 : YYYYYYYYYYYYYYYYY
	accionProsa : YYYYYYYYYYYYYYYYY
	tipoServicio : YYYYYYYYYYYYYYYYY
	log : yyyyyyyyy.YYYYYYYYYYYYYYYYY
	ape1 : YYYYYYYYYYYYYYYYY
	anioNacimiento : YYYYYYYYYYYYYYYYY
	nombre : YYYYYYYYYYYYYYYYY
	diaNacimiento : YYYYYYYYYYYYYYYYY

I have tried with this grok pattern:

(?m)%{TIMESTAMP_ISO8601:Fecha} %{LOGLEVEL:LogLevel}%{DATA}(?:accion : (%{USERNAME:Accion})?)%{DATA}(?:accionProsa : (%{USERNAME:AccionProsa})?)%{DATA}(?:tipoServicio : (%{USERNAME:TipoServ})?)

but it dissapears when i set the fields as optionals and i delete one of those fields.

2

I would suggest using an array of patterns, like this.

3

Another approach would be to capture the entire key/value sequence to a temporary field, then to use the KV filter plugin to parse the arbitrary set of key/value to their own fields.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.