grok have patterns to skip value

Question

My grok patterns have problem skip value. Please help me to fix my patterns.

My value:

2013-02-28 09:57:56,SERVICEID|0863591797|topup|C00000001||10.0|20170110|N|aaa|bbb|ccc|aaaaabbb|ccccc|kkkkk|hhhhh

My grok pattern:

^%{TIMESTAMP_ISO8601:timestamp}\,%{WORD:SERVICE}\|%{WORD:MSISDN}\|%{WORD:RULEID}\|%{WORD:CAMPCODE}\|(?:.*|%{WORD:CURRENT})\|(?<EVENTVALUE>(?:%{BASE10NUM}))\|%{WORD:EVNETDTTM}\|%{WORD:NEXTWAVE}\|%{GREEDYDATA:NAMEVALUEPAIR}

EVENTVALUE should be 10.0 but can't this value after parsing '20170110' and EVNETDTTM is 'N'

Phonolog · Accepted Answer · 2017-11-12T09:04:40.030

0

I'n not sure what you're trying to achieve but following grok expression should match your message:

%{TIMESTAMP_ISO8601:timestamp}\,%{WORD:SERVICE}\|%{WORD:MSISDN}\|%{WORD:RULEID}\|%{WORD:CAMPCODE}\|\|%{NUMBER:CURRENT}\|%{WORD:EVNETDTTM}\|%{WORD:NEXTWAVE}\|%{GREEDYDATA:NAMEVALUEPAIR}

Results on https://grokconstructor.appspot.com:

Edit: If the two backslashes mean that there might be an optional value in between there you could use the following pattern:

%{TIMESTAMP_ISO8601:timestamp}\,%{WORD:SERVICE}\|%{WORD:MSISDN}\|%{WORD:RULEID}\|%{WORD:CAMPCODE}\|(%{WORD:CURRENT})?\|%{NUMBER:EVNETDTTM}\|%{WORD:NEXTWAVE}\|%{GREEDYDATA:NAMEVALUEPAIR}

(%{WORD:CURRENT})? means that CURRENT will be optional, see this question for more details.

New results:

edited Nov 12 '17 at 09:04

answered Nov 06 '17 at 18:27

Phonolog

6,321
3
36
64

This field "CURRENT" have value null i need to keep null in this filed.my Grok need to read every filed if some filed have null value. i need to keep it not to skip – Gaoo Nin Rice Nov 07 '17 at 02:55
I saw it. Thank you. – Gaoo Nin Rice Nov 16 '17 at 10:11

score 0 · Answer 2 · answered Nov 09 '17 at 12:59

0

I would suggest using the filter plugin csv. If you grok out the timestamp and the comma (like in your grok) you could specify the "|" as separator for the csv plugin.

answered Nov 09 '17 at 12:59

HauLuk

155
1
11

grok have patterns to skip value

2 Answers2