I am using the below grok filter to parse the Apache logs pattern.
The grok filter is :
The first field clientip is optional so have added ? in it. The same applies to cust. cust is also optional.
And the logs are (A part of the Apache log)
But the above condition is not matching. I tried to split the above filter to see whether each term is matching or not. So, till cust it's matching without any issues, but it's not matching the | (pipe character).