Logstash grok filter fails to match for some messages -


i'm trying parse application's logs logstash (version 1.4.2) , grok, reason don't understand, grok fails parse of lines should match specified filter. i've searched google , stackoverflow, of problems other people had seemed related multiline log messages (which isn't case me), , couldn't find solved problem.

my filter looks this:

filter {   grok {     match => { "message" => "%{syslogbase} -(?<script>\w*)-: adding item id %{word:item_id} database."}     add_tag => ["insert_item"]   } } 

here's message field of line parsed correctly:

may 11 16:47:55 myhost rqworker: -script-: adding item id 982663745238221172_227691295 database. 

and here's message field of line isn't:

may 11 16:47:55 myhost rqworker: -script-: adding item id 982663772746479443_1639853260 database. 

the thing differs between these messages item's id, , grok debugger parses them both correctly.

i've checked logstash log file, didn't see relevant error messages.

i'm starting out logstash , have no idea happening here; appreciated!


Comments

Popular posts from this blog

android - MPAndroidChart - How to add Annotations or images to the chart -

javascript - Add class to another page attribute using URL id - Jquery -

firefox - Where is 'webgl.osmesalib' parameter? -