Regex Fails when space is removed in grok debugger

Question

I'm trying to extract date from a log file entry:

 ......
 Date is:2015-06-09
 ........

using grok debugger for logstash.

The regex I'm using is (?<=Date is:)[0-9\-]*\s? This regex works on regex101 but there aren't any matches in grok debugger.

Interestingly, if I add a space after : in both regex and file entry, the grok debugger gives correct results.

why it's not `^Date is\:(.*)$` or `^Date is\:(\d\d\d\d\-\d\d\-\d\d)$` ? — , Jun 16 '15 at 21:12
Is the colon `:` a special character in groc? Otherwise, try and just match `:[0-9]`. Does that work? — , Jun 16 '15 at 21:22
@LucasTrzesniewski Actually no, but that change resolved the issue..thanks! :D — Yellowjacket, Jun 16 '15 at 21:25
Its better to know why something doesn't work than to guess the rest of your life. — , Jun 16 '15 at 21:34

depperm · Answer 1 · 2015-06-17T00:37:57.683

0

You could try:

((?<=Date is:)[\d\-]+\s?)|((?<=Date is: )[\d\-]+\s?)

First I added + instead of * as there is at least one date. One side of the regex checks for a Date is: with no space following the colon, the other side has a space after the colon then the date.

edited Jun 17 '15 at 00:37

answered Jun 17 '15 at 00:10

depperm

10,606
4
43
67

Can you elaborate on what this regex is doing? – orde Jun 17 '15 at 00:36

Regex Fails when space is removed in grok debugger

1 Answers1