Grok pattern from documentation fails to match

Graylog Central (peer support)
1

Hello everybody,

i am helpless. I just installed graylog and want to make a simple test with grok pattern. I am using the example from the documentation:

message:
len=50824 src=172.17.22.108 sport=829 dst=192.168.70.66 dport=513
Grok pattern:
len=%{NUMBER:length} src=%{IP:srcip} sport=%{NUMBER:srcport} dst=%{IP:dstip} dport=%{NUMBER:dstport}

The pattern doesnt match in the Extractor configuration. The pattern %{DATA} also doesnt match. Can anyone tell me what i am doing wrong?

Update: ive also tried regular expressions. Nothing works. It seems that somethings wrong with my installation but i cant figure out what.

Update2: it seems that the message i sent via Java-Socket was not correct! Problem ist solved!

Thanks!

2

In case you weren’t aware, there’s a great GROK debugger that can help develop and test out your GROK patterns in the future.

https://grokdebug.herokuapp.com/

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.