hello guys,
i have a java log line "BusinessServiceImpl.java:7651)" and i want to stop just at the character ")" how can i do that with grok.
thanks in advance.
hello guys,
i have a java log line "BusinessServiceImpl.java:7651)" and i want to stop just at the character ")" how can i do that with grok.
thanks in advance.
grok { match => { "message" => "^(?<foo>[^\)]+)" } }
That is, from the beginning of line, any characters that are not ). That will stop capturing before the ).
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.