Welcome to OGeek Q&A Community for programmer and developer-Open, Learning and Share
Welcome To Ask or Share your Answers For Others

Categories

0 votes
1.3k views
in Technique[技术] by (71.8m points)

regex - Logstash optional fields in logfile

I'm trying to parse a logfile using grok

Each line of the logfile has fields separated by commas:

13,home,ABC,Get,,Private, Public,1.2.3 ecc...

I'm using match like this: match => [ "message", "%{NUMBER:requestId},%{WORD:ServerHost},%{WORD:Service},...

My question is: Can I allow optional field? At times some of the fileds might be empty ,,

Is there a pattern that matches a string like this 2.3.5 ? ( a kind of version number )

See Question&Answers more detail:os

与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…
Welcome To Ask or Share your Answers For Others

1 Reply

0 votes
by (71.8m points)

At it's base, grok is based on regular expressions, so you can surround a pattern with ()? to make it optional -- for example (%{NUMBER:requestId})?,

If there isn't a grok pattern that suits your needs, you can always create a named extraction like this: (?<version>[d.]+) which would extract into version, a string that has any number of digits and dots in it.


与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…
OGeek|极客中国-欢迎来到极客的世界,一个免费开放的程序员编程交流平台!开放,进步,分享!让技术改变生活,让极客改变未来! Welcome to OGeek Q&A Community for programmer and developer-Open, Learning and Share
Click Here to Ask a Question

...