Unable to extract hostname with Grok using NOTSPACE

Elastic Stack Logstash
1

Hello, trying to extract a hostname from a log. I test my Grok filter in the Grok debugger using the NOTSPACE pattern and I can extract the hostname "DEV-1010-1010-D-B1F6R01". But in Kibana, I get a "invalid" message for that index pattern. I've already tried to refresh my index patterns with no success. I can extract the other lines from the log file just fine, the hostname in this log line is "DEV-1010-1010-D-B1F6R01"

Here is one line from my log:
Dec 13 13:33:42 Men and Mice Central: [10640 DHCPSynchronizationThread] Error sending scope list request to DHCP server "DEV-1010-1010-D-B1F6R01."

Here is my grok filter:

filter {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:time_stamp} %{DATA:app_source} %{GREEDYDATA:error_message} %{NOTSPACE:dhcp_hostname}" }
}
}

Here is the output in Kibana

image

Thank you.

2

Does it fetches app_source ? Also Can you specify delimiters for app_source and error_message in the message ?

3

Hi,
can you post your logs

4

It does fetch app_source and error_message, see the delimiters it comes back with below. Here is the log line:
Dec 13 13:33:42 Men and Mice Central: [10640 DHCPSynchronizationThread] Error sending scope list request to DHCP server "HOU-AS01-2960-D-B1F6R01."

Delimiters:
app_source:Men and Mice Central
error_message: [10640 DHCPSynchronizationThread] Error sending scope list request to DHCP server

Here is my filter:
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:time_stamp} %{DATA:app_source} %{GREEDYDATA:error_message} %{NOTSPACE:dhcp.hostname}" }
}

5

Here is one line of the logs, they all pretty much look the same. Thanks

Dec 13 13:33:42 Men and Mice Central: [10640 DHCPSynchronizationThread] Error sending scope list request to DHCP server "HOU-AS01-2960-D-B1F6R01."

6

Update: I was able to use Dissect to retrieve the hostname from the log lines. Here is my filter.
dissect {
mapping => {
"message" => "%{syslog_timestamp} %{+syslog_timestamp} %{+syslog_timestamp} %{logsource} %{+logsource} %{+logsource} %{+logsource} %{} %{} %{} %{} %{} %{} %{} %{} %{} %{} %{dhcp_hostname}"
}
}

I need to figure out a way to group the empty fields and avoid having multiple %{} delimiters. Thanks to those that replied.

7

Update to this case. I was able to group fields together. See link below.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.