CODEWITHSUNDEEP
logstashlogstash-grok
Shivkumar Mallesappa
Shivkumar Mallesappa

Reputation: 3077

Logstash grok for special character

Following is my log

# Time: 2017-11-02T07:41:22.631956Z# User@Host: root[root] @ localhost []  Id:

I am not able to write grok pattern for the word root[root]. I want this value as a single column. Example : host = root[root].

I want [ in my value.

How to do this ?

Upvotes: 2

Views: 13265

Answers (1)

Phonolog
Phonolog

Reputation: 6511

%{DATA:user} should do.

You can see the definition for DATA here.

A grok filter for parsing your whole logline could look somewhat like this (I'm not really sure which parts you're interested in but you get the idea):

# Time: %{TIMESTAMP_ISO8601:timestamp}# %{DATA:user}@%{DATA:host}: %{DATA:user2} @ %{DATA:host2} \[\]  Id:

Results from https://grokconstructor.appspot.com: enter image description here

Upvotes: 6

Related Questions