Logstash Grok Pattern

Question

I am new to logstash and trying to custom GROK one log file could some one please guide me on how to custom grok this log.

Log entry:

configmgr.service.configservice - revoke_app_config - Revoking config for app

I want to grok it in such a way that it should populate the below fields as:

PROGMODULE = configmgr.service.configservice PROGBLOCK = revoke_app_config ACTION = Revoking config for app

Answer 1

Have you tried something like below?

%{NOTSPACE:PROGMODULE} - %{WORD:PROGBLOCK} - %{GREEDYDATA:ACTION}