GROK pattern for optional field

Question

I have a log string like :

2018-08-02 12:02:25.904 [http-nio-8080-exec-1] WARN  o.s.w.s.m.s.DefaultHandlerExceptionResolver.handleTypeMismatch - Failed to bind request element

In the above string [http-nio-8080-exec-1] is a optional field, it can be there in some log statements.

i created a grok patterns like with some references on net :

%{TIMESTAMP_ISO8601:timestamp} (\[%{DATA:thread}\])? %{LOGLEVEL:level}%{SPACE}%{JAVACLASS:class}\.%{DATA:method} - %{GREEDYDATA:loggedString}

seems its not working if i remove the thread name string.

score 7 · Accepted Answer · answered Aug 02 '18 at 07:21

7

you need to make the space character following the thread name optional: (\[%{DATA:thread}\] )?

input:

2018-08-02 12:02:25.904 WARN  o.s.w.s.m.s.DefaultHandlerExceptionResolver.handleTypeMismatch - Failed to bind request element

pattern:

%{TIMESTAMP_ISO8601:timestamp} (\[%{DATA:thread}\] )?%{LOGLEVEL:level}%{SPACE}%{JAVACLASS:class}\.%{DATA:method} - %{GREEDYDATA:loggedString}

output:

{
  "loggedString": "Failed to bind request element",
  "method": "handleTypeMismatch",
  "level": "WARN",
  "class": "o.s.w.s.m.s.DefaultHandlerExceptionResolver",
  "timestamp": "2018-08-02 12:02:25.904"
}

answered Aug 02 '18 at 07:21

georgexsh

15,984
2
37
62

Its correct but how it worked ? i had given the space anyway right ? – Raghuveer Aug 02 '18 at 09:40
you could compare the two patterns char by char and would find the difference. – georgexsh Aug 02 '18 at 09:42
I only different is i have give space outside `)?` and you have given inside. Not sure how its making a difference. – Raghuveer Aug 02 '18 at 09:52
if the field is missing, the field separator - space char - should not be matched as well. – georgexsh Aug 02 '18 at 09:53

GROK pattern for optional field

1 Answers1