Problem with grok and multiline pattern


(Rodolphe Redouté) #1

Hi, I have a touchy problem,

I need to make a filter for a log file but here is the thing :

inside this file there is some log with Multiline and the begining of theses lines is not the same than the "one line"
here is exemple :

here are the 2 types of "one line" logs :

 [2017-10-05 16:24:55 +0200 SERVICE]: enabling watch folder: /data/server/incoming/dash_vod/

2017-10-05 14:38:38 F Pipeline cancelled while waiting for decoded picture.

and here is a multiline log :

[2017-10-05 16:38:39 +0200 SERVICE]: EME returned error:
 <response value="error">
  <error value="1999">
    <message>Video decoder: [Error in MPEG-2 GPU decode]</message>
  </error>
</response>

so here is my problem : I can't create a Multiline Pattern because, i tried to make my log line start with the date (2017-10-05 16:38:39) but when i do this, the lines which start with a "[" are stuck with the last line of this format, and when i try to make my log line start with the "[" same problem appear reciprocally

i tried both of theses multiline pattern :
^([0-9]{4}-[0-9]{2}-[0-9]{2})
^([[0-9]{4}-[0-9]{2}-[0-9]{2})

To be more precise i need a solution to manage theses two kind of line

i'm not sure i'm clear in my explanation, so if anyone has a clue to help me that would be great !

Thx for reading.


(Rodolphe Redouté) #2

okey i found a solution :

in my multiline pattern i used ^(expr1|expr2) with both my expressions and it worked.


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.