Grok pattern from documentation fails to match


Hello everybody,

i am helpless. I just installed graylog and want to make a simple test with grok pattern. I am using the example from the documentation:

len=50824 src= sport=829 dst= dport=513
Grok pattern:
len=%{NUMBER:length} src=%{IP:srcip} sport=%{NUMBER:srcport} dst=%{IP:dstip} dport=%{NUMBER:dstport}

The pattern doesnt match in the Extractor configuration. The pattern %{DATA} also doesnt match. Can anyone tell me what i am doing wrong?

Update: ive also tried regular expressions. Nothing works. It seems that somethings wrong with my installation but i cant figure out what.

Update2: it seems that the message i sent via Java-Socket was not correct! Problem ist solved!


(Rob) #2

In case you weren’t aware, there’s a great GROK debugger that can help develop and test out your GROK patterns in the future.

(system) #3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.