Grok pattern for space OR double space

[n***@public.gmane.org]

Hello,

I am collecting the following logs :
Nov 22 11:45:02 ...
Dec 3 11:45:02 ...

Depending on the date, I am sometimes getting one or two space between the
month and the monthday

My grok pattern for 1 space was : "%{MONTH}%{SPACE}%{MONTHDAY} .*"]

I have tried to add a custom pattern for matching one or two space :
SPACE \s*
ONEORTWOSPACE ((?:%{SPACE})|(?:(%{SPACE}%{SPACE})))

I have already tried to add / remove some () but my syntax seems to be
wrong as logstash doesn't start

Thanks for your help !

--

[Jordan Sissel]

Post by n***@public.gmane.org
Hello,
Nov 22 11:45:02 ...
Dec 3 11:45:02 ...
Depending on the date, I am sometimes getting one or two space between the
month and the monthday
My grok pattern for 1 space was : "%{MONTH}%{SPACE}%{MONTHDAY} .*"]
SPACE \s*
ONEORTWOSPACE ((?:%{SPACE})|(?:(%{SPACE}%{SPACE})))
I have already tried to add / remove some () but my syntax seems to be
wrong as logstash doesn't start
Thanks for your help !

Grok is literally a thin wrapping on a regular expression engine.
You can just do:

pattern => "%{MONTH} +%{MONTHDAY} %{TIME}"

This allows any number of spaces, as long as it is at least one, between
month and monthday. If you really want to get specific, you can do:
"%{MONTH} {1,2}%{MONTHDAY} ..." to permit 1 or 2 spaces only.

-Jordan

--

[n***@public.gmane.org]

Thanks for your help and these explanaitions ! It works fine now.

Post by Jordan Sissel

Post by n***@public.gmane.org
Hello,
Nov 22 11:45:02 ...
Dec 3 11:45:02 ...
Depending on the date, I am sometimes getting one or two space between
the month and the monthday
My grok pattern for 1 space was : "%{MONTH}%{SPACE}%{MONTHDAY} .*"]
SPACE \s*
ONEORTWOSPACE ((?:%{SPACE})|(?:(%{SPACE}%{SPACE})))
I have already tried to add / remove some () but my syntax seems to be
wrong as logstash doesn't start
Thanks for your help !

Grok is literally a thin wrapping on a regular expression engine.
pattern => "%{MONTH} +%{MONTHDAY} %{TIME}"
This allows any number of spaces, as long as it is at least one, between
"%{MONTH} {1,2}%{MONTHDAY} ..." to permit 1 or 2 spaces only.
-Jordan

--