Parsing using grok

Elastic Stack Logstash
1

i am running jdbc and getting following data. if I run this on SQL> prompt

--backupid "2129214415_30120163393540,2129214415_30120163432904" --spoolpath /system1/1_backup

but on logstash output it becomes

command:  "--backupid \"2129214415_30120163393540,2129214415_30120163432904\" --spoolpath /system1/1_backup"

how do I parse this and get 2129214415_30120163393540

I try this but it does not work

grok {
             tag_on_failure => ["grok_parse_failed"]
             match => {"command" =>  "--backupid \\"%{GREEDYDATA:myid},%{GREEDYDATA:myid2}\\" }
}

I even try with different \ combination to esacpe that backslash and "

it works on grok debugger when I try

this works
image

This works as well

image
image695×217 6.87 KB

2

The actual value of the command field is --backupid "2129214415_30120163393540,2129214415_30120163432904" --spoolpath /system1/1_backup". There are no backslashes in it, those are just being used as escapes for the double quotes inside the string. Try

match => { "command" => '--backupid "%{DATA:myid1},%{DATA:myid2}"' }
1 Like
3

Thank you Badger.

that single quote I didn't know I can use it. plus DATA in place of GREEDYDATA

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.