Parse optional field with or without leading spaces

Elastic Stack Logstash
1

hello,

i am trying to parse the following log messages with grok:

  1. [2017-02-21T16:20:11.709Z] [debug] [mosaicresult] publish mosaicresult client id: gIsdfdsfgvdsfvdfs channel: localMosaicChannel [{"ffvfv":"dfvfdvdfv"}]
  2. [2017-02-21T16:20:11.709Z] [debug] [mosaicresult] publish mosaicresult client id: gIsdfdsfgvdsfvdfs channel: localMosaicChannel

the last part that marked is optional .
when it doesnt exist, there are no spaces at the end of log message , and when exits , there is.

the regexp used for both logs:
[%{TIMESTAMP_ISO8601:datetime}] [%{LOGLEVEL:level}] [%{NOTSPACE:serviceName}] %{GREEDYDATA:logMessage}(\s*)([%{GREEDYDATA:meta}])?

problem: the result for the first log is that meta field is empty, that is the problem.

please advise.
thanks .

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.