Pattern failure with grok due a longer integer in a column

Question

I have used grok debugger to get the top format working and it is being seen fine by elasticsearch. Eventually, when a log line like the one below hit it shoots out a tag with "grokparsefailure" due to the extra space before each integer (I'm assuming). Is there a tag I can use to accept anything no matter how long or short for each column?

0000003B 2015-03-14 07:46:14.618 16117 16121

00000DA1 2015-03-14 07:45:54.609  6382  6382

score 1 · Answer 1 · answered Mar 16 '15 at 14:54

1

It's also possible to use the built in logstash pattern %{SPACE} to match any number of whitespace characters.

%{INT:num1}%{SPACE}%{INT:num2}

answered Mar 16 '15 at 14:54

kev.p.g

46
2
8

pcproff · Answer 2 · 2015-03-15T18:03:39.667

0

I ended up doing a custom filter since I knew my values were between 4-5 characters and then used patterns_dir => "./patterns" in my conf file.

_ID [0-9A-F]{4,5}

_ID2 [0-9A-F]{4,5}

UPDATE*****

my solution did not work because the number can be anywhere from 3 to 6 characters. The easier solution was provided above. Marked as answer.

edited Mar 15 '15 at 18:03

answered Mar 14 '15 at 22:58

pcproff

612
1
8
30

score 0 · Accepted Answer · answered Mar 15 '15 at 16:13

0

One or more spaces between two integers:

%{INT} +%{INT}

answered Mar 15 '15 at 16:13

Alain Collins

16,268
2
32
55

Pattern failure with grok due a longer integer in a column

3 Answers3