I am using the below grok filter to parse the Apache logs pattern.
The grok filter is :
(%{IPORHOST:clientip})?|%{QUOTEDSTRING:user}|(%{WORD:cust})?|
The first field clientip is optional so have added ? in it. The same applies to cust. cust is also optional.
And the logs are (A part of the Apache log)
-|"User1"|-|
But the above condition is not matching. I tried to split the above filter to see whether each term is matching or not. So, till cust it's matching without any issues, but it's not matching the | (pipe character).
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.