Grok custom pattern

Question

I have the simple message coming in my logstash:

2018-09-30 20:25:07.708  INFO 8013 --- [nio-8443-exec-3] c.e.demo.controller.UsuarioController    : INICIO CHAMADA | 311

I want to remove the following field from this message.

"311"

Val · Accepted Answer · 2018-10-01 05:04:12Z

2

You're almost there. You simply need to escape the pipe | character with a backslash (otherwise it matches the 801 after INFO), like this:

: INICIO CHAMADA \| (?<identificador_chamada>[0-9]{3})
                 ^
                 |
             add this

and you'll get this

{
  "identificador_chamada": [
    "311"
  ]
}

answered Oct 1, 2018 at 5:04

Val

218k14 gold badges377 silver badges384 bronze badges

Sign up to request clarification or add additional context in comments.

1 Answer 1