Pattern matching Problem

(Anil Kumar) #1

Is it correct pattern matching with below log. Actually i got _grokParseFaliure error is coming.

Log is: (Log4jNet) type log

2015-04-17 23:35:46,932 [10] DEBUG - Customer already exists...

conservation pattern in properties file:

<conversionPattern value="%date [%thread] %level %logger - %message%newline"/>

Pattern is:'

(?m)%{TIMESTAMP_ISO8601:time} [%{NUMBER:thread}] \ %{LOGLEVEL:loglevel} - %{GREEDYDATA:message}

(Magnus Bäck) #2

Square brackets are metacharacters so [%{NUMBER:thread}] needs to be \[%{NUMBER:thread}\].

(Anil Kumar) #3

Thanks, @magnusbaeck can you check below log.

2015-04-17 23:35:46,932 [10] DEBUG NCR.XE.Component.MessageHandler.HistoryEventMessageProcessor - Customer_ID already exists...

<conversionPattern value="%date [%thread] %level %logger - %message%newline"/>

i am confusing after Loglevel (NCR.XE....)

(Magnus Bäck) #4

Ah, right. You're not capturing the logger either. Loggers should never have spaces in their names (they're almost always class names) so you can use %{NOTSPACE:logger} or perhaps %{JAVACLASS:logger}.

(Anil Kumar) #5

Thanks @magnusbaeck it's working now but i am getting small problem. I am using the logstash configuration, like below

grok {
match => { "message" => "%{TIMESTAMP_ISO8601:time} [%{NUMBER:thread}] %{LOGLEVEL:loglevel} %{JAVACLASS:class} -%{GREEDYDATA:message} " }

mutate {
add_field => {
"loglevel" => "%{LOGLEVEL:loglevel}"


I want only Loglevel (ERROR,DEBUG,WARN) but it's giving "%{LOGLEVEL:loglevel}" also

(Magnus Bäck) #6

Remove the mutate filter. You've already captured the loglevel field so there's no reason to add it again.

(Anil Kumar) #7

Thanks @magnusbaeck ......Now it's working fine.

(system) #8