CODEWITHSUNDEEP
regexlogstashlogstash-grok
dina
dina

Reputation: 4289

how to match first regex occurrence using grok filter

my logs are in the following format my.package.name classname: my_message

I would like to cut the class perfix .

for example:

com.example.Handler doPost: request received, jim:jay foo: bar

convert to:

request received, jim:jay foo: bar

I tied this

filter {
  grok {
    match => {"message" => "^(.*):%{GREEDYDATA:request}"}
  }
}

output { stdout { codec => rubydebug  }}

but this is what I get: 

{
       "request" => " bar",
       "message" => "com.example.Handler doPost:  request  received, jim:jay foo: bar"
       ...
}

seems like grok matches by last regex occurrence.

how can I match by first : occurrence?

Upvotes: 1

Views: 3995

Answers (1)

Will Barnwell
Will Barnwell

Reputation: 4089

Use a reluctant .* by using .*?. A normal .* will match as much as it can while a reluctant .*? will match as little as it can.

Fun fact: The logstash grok DATA patterns are 

DATA .*?
GREEDYDATA .*

So you can define your pattern as

^%{DATA}:%{GREEDYDATA:request}

Upvotes: 3

Related Questions