Grok pattern (?<message>(.|\r|\n)*) doesn't work with large messages

[ernurit1]

Grok pattern (?(.|\r|\n)) doesn’t work with large messages
if I have large message and use Grok pattern (?(.|\r|\n)) then get mistake

[jan (Jan Doberstein)]

But the given string is not a grok pattern - that is a regex, without any grok part.

What is a large message for you?

[ernurit1]

@jan

For example, my message have 6500 characters. I want to break it up on the date and all the rest
<%{DATA:time}>(?message>(.|\r|\n)*). I have error.Could you tell me how decide this problem?

[jan (Jan Doberstein)]

I want to break it up on the date and all the rest

For me, it is not clear what you want todo on what kind of data. Sorry, you might want to rephrase your question and provide more/additional information.

[ernurit1]

@jan

Timestamp is different from time of log. I want to do a time search in the logs. I can do it using grok pattern
<%{DATA:time}>%{SPACE}<%{GREEDYDATA:message}
but GREEDYDATA gives me an incomplete message so I use
(?<message(.|\r|\n)*)
Maybe there is another way. I don’t know