i new logstash , grok filters. trying parse string apache access log, grok filter in logstash, username part of access log in following format:
name1.name2.name3.namex.id
i want build new field called username name1.name2.name3.namex id stripped off. have working, problem number of names variable. there 3 names (lastname.firstname.middlename) , there 4 names (lastname.firstname.middlename.suffix - smith.george.allen.jr
%{word:lastname}.%{word:firstname}.%{word:middle}.%{word:id}
when there 4 names or more not parse correctly. hoping can me out right grok filter. know missing pretty simple.
you use 2 patterns, adding 1 matches when there 4 fields:
%{word:lastname}.%{word:firstname}.%{word:middle}.%{word:suffix}.%{word:id}
but in case, you're creating fields sounds don't want.
how pattern splits off id, leaving in front of it, perhaps:
%{data:name}.%{int}
Comments
Post a Comment