List of SYNTAX for logstash's grok

logstash logstash-grok
user1411110 picture user1411110 · May 7, 2014 · Viewed 34.9k times · Source

The syntax for a grok pattern is %{SYNTAX:SEMANTIC}. How do i generate a list of all available SYNTAX keywords ? I know that I can use the grok debugger to discover patterns from text. But is there a list which i can scan through?

Answer

Alcanzar picture Alcanzar · May 7, 2014

They are in GIT and included somewhere in the distribution. But it's probably just easiest to view it online:

https://github.com/elasticsearch/logstash/blob/v1.4.0/patterns/grok-patterns

Related questions

How to handle non-matching Logstash grok filters

I am wondering what the best approach to take with my Logstash Grok filters. I have some filters that are for specific log entries, and won't apply to all entries. The ones that don't apply always generate _grokparsefailure tags. For …

Read More
Is there any existing grok{} pattern for date format YYYY/MM/DD HH:mm:ss?

I was checking the nginx error logs at our server and found that they start with date formatted as: 2015/08/30 05:55:20 i.e. YYYY/MM/DD HH:mm:ss. I was trying to find an existing grok date pattern which might help …

Read More
How to process multiline log entry with logstash filter?

Background: I have a custom generated log file that has the following pattern : [2014-03-02 17:34:20] - 127.0.0.1|ERROR| E:\xampp\htdocs\test.php|123|subject|The error message goes here ; array ( 'create' => array ( 'key1' => 'value1', 'key2' => …

Read More