Grok Filtering not picking up "<" character

Description

I have a string that I have been working through in the Grok Debugger but I think there may be a bug in the GREEDYDATA pattern.

Here is the example:

2014-02-02 17:14:44.852-05:00 [HOST:USPADVMSRSV1V][PID:7108][THR:8124][Kernel][Error] <FAILED INSTANCE 'C2A609E64855842EE37E84A93A8F329E'> Distribution Service: MSIDeliveryEngine:: Subscription 'Spring 13 Coordinates 6/28/12 3:33:20 PM' MSIJob Execution Error: Job ID = 142649, Error code = 0x80043014, Comp Error code = 0x00000000)

I've gotten it to parse successfully but it doesn't include "<FAILED INSTANCE 'C2A609E64855842EE37E84A93A8F329E'>"

here is my pattern:

%{TIMESTAMP_ISO8601:log_timestamp} \[HOST:%{DATA:source_host}\]\[PID:%{INT:pid}\]\[THR:%{INT:thread}\]\[%{DATA:component}\]\[%{DATA:dispatcher}\]%{SPACE}%{GREEDYDATA:event}

Below is what my output looks like in the debugger.

{ "log_timestamp": [ [ "2014-02-02 17:14:44.852-05:00" ] ], "source_host": [ [ "USPADVMSRSV1V" ] ], "pid": [ [ "7108" ] ], "thread": [ [ "8124" ] ], "component": [ [ "Kernel" ] ], "dispatcher": [ [ "Error" ] ], "event": [ [ " Distribution Service: MSIDeliveryEngine:: Subscription 'Spring 13 Coordinates 6/28/12 3:33:20 PM' MSIJob Execution Error: Job ID = 142649, Error code = 0x80043014, Comp Error code = 0x00000000)" ] ] }

discovered while testing

Gliffy Diagrams

Activity

Show:

Philippe Weber April 11, 2014 at 7:30 AM

Cannot reproduce in master,
so it seems to have been fixed in the meanwhile

Fixed

Details

Assignee

Reporter

Affects versions

Created February 6, 2014 at 4:27 AM
Updated April 11, 2014 at 7:30 AM
Resolved April 11, 2014 at 7:30 AM