localhost CROND[1979]: (root) CMD (run-parts /etc/cron.hourly)
How can I write this in the grok pattern path?
I have a project that I should give tomorrow morning.
So I have to reach the direct result.Thanks for help.
Try to use this:
%{SYSLOGHOST:logsource} %{PROG:program}(?:[%{POSINT:pid}])?: (%{USER:cron_user}) %{DATA:cron_action} (%{DATA:cron_message})
Don’t forget to study documentation:
https://docs.graylog.org/en/3.1/pages/extractors.html#using-grok-patterns-to-extract-data
Great examples you can also find in:
1 Like
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.