logstash _grokparsefailure issues -


i'm having issues grok parsing. in elasticsearch/kibana lines match come tag _grokparsefailure.

here logstash config :

input {      file {       type => logfile       path => ["/var/log/mylog.log"]      }    }  filter {      if [type] == "logfile"      {        mutate {       gsub => ["message","\"","'"]       }        grok          { match => { "message" => "l %{date} - %{time}: " } }      }  }   output {     elasticsearch { host => localhost port => 9300 }  } 

lines/patterns i'm trying match : l 08/02/2014 - 22:55:49: log file closed : " finished "

i tried debugger on http://grokdebug.herokuapp.com/ , works fine, pattern matches correctly.

lines want parse might contain double quotes, , i've read there can issues way grok handles , escapes them. tried mutate replace " ' avoid issues no luck.

any ideas ? how can debug ?

thanks

found out issue, around double quotes.

needed use simple quote define grok filter, , escape double quotes.

match => { 'message' => 'l %{date:date} - %{time:time}: \"string_between_doublequotes\" ' 

Comments

Popular posts from this blog

javascript - Jquery show_hide, what to add in order to make the page scroll to the bottom of the hidden field once button is clicked -

javascript - Highcharts multi-color line -

javascript - Enter key does not work in search box -