Problem parsing with grok

Elastic Stack Logstash
1

I'm trying to parse the following string using grok:

(ADDRESS=(PROTOCOL=tcp)(HOST=172.18.213.2)(PORT=52737))

I tried using the kv filter but I was having problems regarding the parenthesis...
With the following pattern I got the results:

\((?<field>[^)]*)\((?<prt>[^)]*)\)\((?<host>[^)]*)\)\((?<port>[^)]*)\)

{
  "field": [
    [
      "ADDRESS="
    ]
  ],
  "prt": [
    [
      "PROTOCOL=tcp"
    ]
  ],
  "host": [
    [
      "HOST=172.18.213.2"
    ]
  ],
  "port": [
    [
      "PORT=52737"
    ]
  ]
}

Which is not exactly how I wanted to parse it. Can anyone help me? Maybe there is a way using the kv filter, which would be the easiest way to parse that log...

2

Check this grok filter:

(%{DATA:field}=(%{DATA:prt})(%{DATA:host})(%{DATA:port}))

3

This filter wont work , some / are hided when I am pasted here

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.