Grok Extractor with pipes and Spaces

(Mark) #1

i’m trying to Create a new grok extractor for the following message

03:22:40.734|User                           |||(678): Error message goes here
%{TIME:UTC-TIME}\|%{USER:UserName}%{SPACE}\|%{SPACE}%{IP:SourceIP}\|%{SPACE}%{IP:GWIP}\|\(%{BASE10NUM:ErrorNumber}\): %{GREEDYDATA:ErrorMessage}

this works in GROK debugger but when i put it in graylog i get the following error: Check parameters

I have found where it doesn’t like it, between SourceIP} and |. When i remove everything after SourceIP it works. I put in GREEDYDATA and get
||(678): Error message goes here.

(Jochen) #2

Do all referenced Grok patterns exist in your Graylog cluster? Check at System/Grok patterns.
Anything in the logs of your Graylog nodes?

(Mark) #3

all grok patterns exist. Running 2.4.3

I can’t get to the logs in the server.

Omnibus Package version 2.4.0-rc.2 -

I get access denied when using ubuntu username in the cli

(Jochen) #4

Which one are you running?

You have to be root to access these files. You can use sudo to get root privileges as “ubuntu” user.

(Mark) #5

sorry i was in the middle of upgrading graylog to the latest. So currently running 2.4.3

Log File last 50 lines

Grok Debugger Check

(Jochen) #6

Please create a bug report at and include the complete logs of your Graylog node(s), the failing Grok pattern, one or more example messages, and a content pack of all Grok patterns in your Graylog cluster (System/Content Packs/Create a content pack) or alternatively a dump of the “grok_patterns” collection in MongoDB.

(system) closed #7

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.