Sam67000
(Samir)
July 18, 2017, 7:30am
1
Hello everyone,
I need your help to parse with grok filter two information in two different variable with one filter.
The log line is as follows :
From: DNS_dns[2060]/15885
the first information is : DNS_dns and the second is 15885. Is that possible ?
I try this : match => {"message" => "From: %{WORD:Variable1"}
But it just parse me the first information.
Thank you for the help !
pemontto
(Pemontto)
July 18, 2017, 8:21am
2
Try using https://grokdebug.herokuapp.com/ it's incredibly helpful.
This pattern should do what you want
From: %{WORD:Variable1}%{GREEDYDATA}/%{INT:Variable2}
system
(system)
Closed
August 15, 2017, 8:21am
3
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.