First off, Thanks for help in advance. Please go easy on me, I’m completely new to grok, but trying to lear so I can enhance the use of Graylog.
I’m finding that I cannot do a second parameter correctly, and I’m asking for some help in figuring out what I’m doing. I’ve watched a few youtubers, and read the documentation, and I cannot figure out what I am doing incorrectly.
One thing I normally do when troubleshooting grok patterns in Graylog is to try to get started with the first match only, and then build out from there.
In other words, can you get:
To match the tr_action field? If not, you may need to make some adjustments there (but it should match, at least from what I can tell). Once that matches, add the pattern for your second term after it and see if it matches, and so on.
That’s how I worked to build the statement… But I did it in the simulator website, since it gives more feedback. Even as you have quoted, it does not work. Some reason, graylog doesn’t like the first match at all.