Parsing IBM Integration Bus logs with Grok


searching the internet I didn't find the right grok filter for IBM integration bus logs. At the end I decided to try by may self. Filter is working but I have opinion that it can be better. Below you can find my grok filter with log.

Mar 28 12:12:01 localhost IIB[5979]: IBM Integration Bus v10008 (INDEV2.default) [Thread 21750] (Msg 1/1) BIP2153I: About to 'Start' an integration server.


My questions are as follows:

Could you please give me some hints to improve my filter?
Is it possible for example to take three words with spaces end put in one field? For example:
IBM Integration Bus
I have some words that is not useful for me. Can I skip them?

I am new in this so don't be harsh on me :blush:.

If you don't need it, don't capture it to a variable :wink:


Is is always "three words with spaces", or is it always literally IBM Integration Bus?

If it is the latter, it is easier and more efficient to just include the literal bit in your Grok pattern:

1 Like

And, you probably will want to add the beginning-of-line anchor ^ to the very beginning of your pattern if we know that there isn't going to be random junk before the timestamp.

Without it, when the pattern matcher fails, it will start over from the second letter, fail again, start over with the third letter, fail again, and so-on, making the failure to match pretty computationally expensive.

1 Like

Always is IBM Integration Bus so I can use it :slight_smile:. Thank you very much for your answers, it help me a lot. Also I learn something new :slight_smile:


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.