CODEWITHSUNDEEP
logstashgrok
Morito
Morito

Reputation: 93

Grok with Missing values using logstash

I am trying to grok this inputs with logstash,

Nicolas Lauri 34 
Nicolas 33  #there is one space and it not works.
Nicolas  33 #there are two spaces and it works.

with this pattern

(%{WORD:firstname})? (%{WORD:lastname})? (%{NUMBER:age})?

Using the ()? I ignore missing values and say that are optionals, but the problem is we must put spaces between value to make it works.

i mean if i have this input:

Nicolas  19

i must put exactly two spaces between Nicolas et 19 to grok it correctly.

What should i do to avoid putting spaces ?

Upvotes: 1

Views: 2754

Answers (1)

Alain Collins
Alain Collins

Reputation: 16362

Two choices:

  1. Put the space in your optional pattern: ( %{WORD})?
  2. Allow one or more spaces between elements: %{WORD} +%{WORD}

Upvotes: 1

Related Questions