Parser question

Elastic Stack Logstash
1

Hi,

Any clue why the below parser is failing?

Parser
SPARK_TIMESTAMP %{DATE_EU} %{TIME}
%{SPARK_TIMESTAMP:timestamp} %{LOGLEVEL:loglevel} %{WORD:classname}(:)? ([%{DATA}][UN-%{DATA:userid}][(HSI|ISI)-%{DATA:sessionid}])?%{GREEDYDATA:details}

Log Message
16/11/22 03:28:06 INFO batch.driver.SparkRunner: spark.executorEnv.CC_FILECONN_UPLOAD_BUFFER_SIZE=2M

2

From a quick look I could spot two problems:

  • DATE_EU is for dd/mm/yy dates but your date is yy/mm/dd.
  • WORD doesn't allow periods.
3

Thanks Magnus. That was it.

Regards,
Bharath

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.