CODEWITHSUNDEEP
logstashlogstash-grok
epicGeek
epicGeek

Reputation: 70

How to write the grok expression for my log?

I am trying to write a grok to analysis my logs.

Use logstash 7 to collect logs. But I failed writing grok after many attempts.

Log looks like this:

[2018-09-17 18:53:43] - biz_util.py [Line:55] - [ERROR]-[thread:14836]-[process:9504] - an integer is required

My Grok(fake):

%{TIMESTAMP_ISO8601 :log_time} - %{USERNAME:module}[Line:%{NUMBER:line_no}] - [%{WORD:level}]-[thread:%{NUMBER:thread_no}]-[process:%{NUMBER:process_no}] - %{GREEDYDATA:log}

Only the timestamp part is OK. The others failed.

Upvotes: 0

Views: 154

Answers (2)

Angel H
Angel H

Reputation: 311

This will work,

[%{TIMESTAMP_ISO8601:log_time}] %{NOTSPACE} %{USERNAME:module} [Line:%{BASE10NUM:Line}] %{NOTSPACE} [%{LOGLEVEL}]%{NOTSPACE}[thread:%{BASE10NUM:thread}]%{NOTSPACE}[process:%{BASE10NUM:process}]

Upvotes: 0

LinPy
LinPy

Reputation: 18578

that will work:

\[%{TIMESTAMP_ISO8601:log_time}\] - %{DATA:module} \[Line:%{NUMBER:line_no}\] - \[%{WORD:level}\]-\[thread:%{NUMBER:thread_no}\]-\[process:%{NUMBER:process_no}\] - %{GREEDYDATA:log}

you need to escap [

Upvotes: 1

Related Questions