Logstash grok filter fails to match for some messages -
i'm trying parse application's logs logstash (version 1.4.2) , grok, reason don't understand, grok fails parse of lines should match specified filter. i've searched google , stackoverflow, of problems other people had seemed related multiline log messages (which isn't case me), , couldn't find solved problem.
my filter looks this:
filter { grok { match => { "message" => "%{syslogbase} -(?<script>\w*)-: adding item id %{word:item_id} database."} add_tag => ["insert_item"] } }
here's message field of line parsed correctly:
may 11 16:47:55 myhost rqworker: -script-: adding item id 982663745238221172_227691295 database.
and here's message field of line isn't:
may 11 16:47:55 myhost rqworker: -script-: adding item id 982663772746479443_1639853260 database.
the thing differs between these messages item's id, , grok debugger parses them both correctly.
i've checked logstash log file, didn't see relevant error messages.
i'm starting out logstash , have no idea happening here; appreciated!
Comments
Post a Comment