Grok pattern for repeating strings seperated by comma

Graylog Central (peer support)
1

Hello,

I am trying to extract data from spamd filters which are separated by comma, example:

spamd: result: . 0 - DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,HTML_FONT_LOW_CONTRAST scantime=0.5

string1=DKIMWL_WL_HIGH, string2=DKIM_SIGNED and so on…

sometimes it could have up to different 15 strings and I am not sure how to write grok correct way :thinking: Now I am using “hardcoded” version to extract it (%{WORD:spamd_filter}|%{WORD:spamd_filter},%{WORD:spamd_filter}|%{WORD:spamd_filter},%{WORD:spamd_filter},%{WORD:spamd_filter} and so on........

I would like to get such results:

spamd_filter [“DKIMWL_WL_HIGH”,“DKIM_SIGNED”,“DKIM_VALID”,“HTML_FONT_LOW_CONTRAST”]

using simpler grok, because I am sure there is better way to do it :grinning_face_with_smiling_eyes:

Any help is greatly appreciated!

2

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.