logstash - Paring a variable length dot separated string in grok -


i new logstash , grok filters. trying parse string apache access log, grok filter in logstash, username part of access log in following format:

name1.name2.name3.namex.id 

i want build new field called username name1.name2.name3.namex id stripped off. have working, problem number of names variable. there 3 names (lastname.firstname.middlename) , there 4 names (lastname.firstname.middlename.suffix - smith.george.allen.jr

%{word:lastname}.%{word:firstname}.%{word:middle}.%{word:id} 

when there 4 names or more not parse correctly. hoping can me out right grok filter. know missing pretty simple.

you use 2 patterns, adding 1 matches when there 4 fields:

%{word:lastname}.%{word:firstname}.%{word:middle}.%{word:suffix}.%{word:id} 

but in case, you're creating fields sounds don't want.

how pattern splits off id, leaving in front of it, perhaps:

%{data:name}.%{int} 

Comments