Accommodate uncertain number of Spaces in a log file GROK pattern

China☆狼群 提交于 2020-06-18 10:58:05

问题


This may be a simple question, but in my logs the spaces between different fields are uncertain, that mean in some logs I can see two spaces and in some three between the same fields. How do we accommodate this in GROK?


回答1:


Grok is at it's heart an overlay on Regex's. So in your grok pattern, you can directly use Regex syntax:

 %{WORD} +%{WORD}

So "space+" means one or more spaces. "space*" means 0 or more spaces.

Grok also has a pattern %{SPACE} that is equivilent to " *"




回答2:


You can use %{SPACE}* in your grok pattern for matching uncertian number of spaces. It will match even if spaces are present or not.



来源:https://stackoverflow.com/questions/45487024/accommodate-uncertain-number-of-spaces-in-a-log-file-grok-pattern

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!