CODEWITHSUNDEEP
logstashlogstash-grok
Jamie Abbott
Jamie Abbott

Reputation: 109

logstash grok filter annoyance

Thu Sep 27 15:30:27 BST 2012:- Invalid token $_POST[custom], which indicates the amount, userid

This is from a log file I'm trying to parse using grok for logstash.

The first few fields are ok, and it seemed very close to DATESTAMP_OTHER, but I think that the UK timezone of BST is messing that up.

Got as far as this, but not sure how to make it work!

%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %([PMCEB][SD]T) %{YEAR} %{GREEDYDATA:message}

Upvotes: 2

Views: 8992

Answers (2)

alfredocambera
alfredocambera

Reputation: 3410

Here is my approach to the problem:

TZEXPANDED (?:[PMCEB][SD]T) MYCUSTOM %{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{TZEXPANDED} %{YEAR}

Or if you prefer:

MYCUSTOM %{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{(?:[PMCEB][SD]T)} %{YEAR}

In my opinion, the first option is better, because you can use the pattern later on for something else

Greetings

Upvotes: 0

Adam
Adam

Reputation: 1982

1) Try out the Grok Debugger which will allow you to test your Grok patterns, on the spot.

2) Also, change your %([PMCEB][SD]T) for something like (?<variable_name>(BST)*) to start off with. You are using the wrong syntax for plain regex.

3) Most important Read the docs. Everything I have just mentioned came directly from the docs.

Upvotes: 11

Related Questions