Skip to:
I have a string that I have been working through in the Grok Debugger but I think there may be a bug in the GREEDYDATA pattern.
Here is the example:
2014-02-02 17:14:44.852-05:00 [HOST:USPADVMSRSV1V][PID:7108][THR:8124][Kernel][Error] <FAILED INSTANCE 'C2A609E64855842EE37E84A93A8F329E'> Distribution Service: MSIDeliveryEngine:: Subscription 'Spring 13 Coordinates 6/28/12 3:33:20 PM' MSIJob Execution Error: Job ID = 142649, Error code = 0x80043014, Comp Error code = 0x00000000)
I've gotten it to parse successfully but it doesn't include "<FAILED INSTANCE 'C2A609E64855842EE37E84A93A8F329E'>"
here is my pattern:
%{TIMESTAMP_ISO8601:log_timestamp} \[HOST:%{DATA:source_host}\]\[PID:%{INT:pid}\]\[THR:%{INT:thread}\]\[%{DATA:component}\]\[%{DATA:dispatcher}\]%{SPACE}%{GREEDYDATA:event}
Below is what my output looks like in the debugger.
{ "log_timestamp": [ [ "2014-02-02 17:14:44.852-05:00" ] ], "source_host": [ [ "USPADVMSRSV1V" ] ], "pid": [ [ "7108" ] ], "thread": [ [ "8124" ] ], "component": [ [ "Kernel" ] ], "dispatcher": [ [ "Error" ] ], "event": [ [ " Distribution Service: MSIDeliveryEngine:: Subscription 'Spring 13 Coordinates 6/28/12 3:33:20 PM' MSIJob Execution Error: Job ID = 142649, Error code = 0x80043014, Comp Error code = 0x00000000)" ] ] }
Cannot reproduce in master, so it seems to have been fixed in the meanwhile
I have a string that I have been working through in the Grok Debugger but I think there may be a bug in the GREEDYDATA pattern.
Here is the example:
2014-02-02 17:14:44.852-05:00 [HOST:USPADVMSRSV1V][PID:7108][THR:8124][Kernel][Error] <FAILED INSTANCE 'C2A609E64855842EE37E84A93A8F329E'> Distribution Service: MSIDeliveryEngine:: Subscription 'Spring 13 Coordinates 6/28/12 3:33:20 PM' MSIJob Execution Error: Job ID = 142649, Error code = 0x80043014, Comp Error code = 0x00000000)
I've gotten it to parse successfully but it doesn't include "<FAILED INSTANCE 'C2A609E64855842EE37E84A93A8F329E'>"
here is my pattern:
%{TIMESTAMP_ISO8601:log_timestamp} \[HOST:%{DATA:source_host}\]\[PID:%{INT:pid}\]\[THR:%{INT:thread}\]\[%{DATA:component}\]\[%{DATA:dispatcher}\]%{SPACE}%{GREEDYDATA:event}
Below is what my output looks like in the debugger.
{ "log_timestamp": [ [ "2014-02-02 17:14:44.852-05:00" ] ], "source_host": [ [ "USPADVMSRSV1V" ] ], "pid": [ [ "7108" ] ], "thread": [ [ "8124" ] ], "component": [ [ "Kernel" ] ], "dispatcher": [ [ "Error" ] ], "event": [ [ " Distribution Service: MSIDeliveryEngine:: Subscription 'Spring 13 Coordinates 6/28/12 3:33:20 PM' MSIJob Execution Error: Job ID = 142649, Error code = 0x80043014, Comp Error code = 0x00000000)" ] ] }