Grok Pattern line description

localhost CROND[1979]: (root) CMD (run-parts /etc/cron.hourly)

How can I write this in the grok pattern path?

I have a project that I should give tomorrow morning.
So I have to reach the direct result.Thanks for help.

Try to use this:

%{SYSLOGHOST:logsource} %{PROG:program}(?:[%{POSINT:pid}])?: (%{USER:cron_user}) %{DATA:cron_action} (%{DATA:cron_message})

Don’t forget to study documentation:

Great examples you can also find in:

1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.