ROOT
ROOT

Reputation: 1775

How To Account For Nulls When Pattern matching using Grok?

I am trying to read log data in Apache NiFi using grok but not able to fetch desired output. Here is my sample data:

[2019-07-16 22:20:16] local.INFO: news.index {"mobile":"959404576540","message":Mozilla/5.0 (Linux; Android 8.0.0; ATU-L42 Build/HUAWEIATU-L42; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/66.0.3359.126 Mobile Safari/537.36 a/2.7.0}

I tried with following expression but didn't worked for me.

%{SYSLOG5424SD}%{JAVACLASS}: %{JAVACLASS} {%{QS}:%{QS},%{QS}:%{QS}} 

How can I extract 2019-07-16 22:20:16, 959404576540, Mozilla/5.0 (Linux; Android 8.0.0; ATU-L42 Build/HUAWEIATU-L42; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/66.0.3359.126 Mobile Safari/537.36 a/2.7.0 from the above data?

Edit:

@Emma Your answer is working but if my data contains any null values it is not working. For example:

[2019-07-16 22:20:16] local.INFO: news.index {"mobile":"8765453673","message":null}

Upvotes: 2

Views: 574

Answers (1)

Emma
Emma

Reputation: 27723

This expression,

\[([^]]+?)\](.*?)"mobile":"\s*(\d+)\s*"\s*,\s*"message"\s*:\s*([^}]*?)\s*\}

for instance might be a start to extract those data.


The expression is explained on the top right panel of this demo if you wish to explore/simplify/modify it.

Upvotes: 1

Related Questions