0

I am trying to filter the output of the "last" command using grok.

The grok pattern is only matching the first variable "user" . It is not matching any pattern after it.

Can you please let me know what i am missing here.

Log:

sam     pts/0        172.19.16.3     Tue Mar  3 11:32 - 11:39  (00:07)

Grok pattern used :

match => [ "message", "%{USER:user} %{TTY:terminal}  %{IPORHOST:client} %{TIMESTAMP_ISO8601:date} %{NUMBER:duration}" ]
Stewartside
  • 20,378
  • 12
  • 60
  • 81
shrilesh.naik
  • 1
  • 2

1 Answers1

1

Several issues with your pattern:

  1. List item

you have to take care of the Whitespace

if you have data like:

username    foobar

the pattern:

%{USER:user} %{WORD}

will not match because you have several white spaces between the two words. If you do:

%{USER:user} +%{WORD}

the pattern will match because you tell grok to look for more than one space between the two words. Try to check your pattern with http://grokdebug.herokuapp.com/ one step at a time. First try to work out the GROK patterns for the individual parts and if they work try to put them together one by one.

  1. The pattern tty does not match pts/0 but expects something like /dev/pts/0

Take a look at the pattern definition. They can be found under: https://github.com/logstash-plugins/logstash-patterns-core/tree/master/patterns

The TTY pattern in particular is in: https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/grok-patterns

markus
  • 1,631
  • 2
  • 17
  • 31
  • Thanks Markus , I tried adding "+" but the grok debugger does not match any pattern if i add any thing followed by + , eg "+%" . I tried with the simple example u suggested. It only matches the first word "%{USERNAME:user} " – shrilesh.naik Mar 13 '15 at 06:51
  • @shrilesh.naik: I just tried it with the grok debugger. Data: "markus foobar" matches with %{USER:user} +%{WORD} but not with %{USER:user} %{WORD} – markus Mar 13 '15 at 10:56
  • Hi Markus, Thanks that works , some problem in implementation from my end. – shrilesh.naik Mar 13 '15 at 14:21