Remove characters in grok


(bob_bza) #1

i have string like this

[2017-01-23 21:55:13,840] DEBUG [Channel manager on controller 1]: Controller 1 trying to connect to broker 1 (kafka.controller.ControllerChannelManager)
[2017-01-23 21:55:13,852] DEBUG [Channel manager on controller 1]: Controller 1 trying to connect to broker 3 (kafka.controller.ControllerChannelManager)
[2017-01-23 21:55:13,856] INFO [Controller-1-to-broker-1-send-thread], Starting (kafka.controller.RequestSendThread)

i was using this regular expression
^[%{TIMESTAMP_ISO8601:time}]\s+%{LOGLEVEL:log-level} [%{DATA:class}]%{GREEDYDATA:message}

output:
message :·Controller·1·trying·to·connect·to·broker·1·(kafka.controller.ControllerChannelManager)
message :·Controller·1·trying·to·connect·to·broker·3·(kafka.controller.ControllerChannelManager)
message ,·Starting··(kafka.controller.RequestSendThread)

i was trying to remove ; ,
issue was for some stringgs have , some have - some have : etc


(Magnus Bäck) #2

Change

%{GREEDYDATA:message}

to

[,:]\s+%{GREEDYDATA:message}

(bob_bza) #4

thanks it works.


(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.