How to use Regex

Graylog Central (peer support)
1

I don’t know how to use Regex to process log messages in JSON format. I would like to find some examples. Can I provide some trouble? thank you very much.

2

What are you trying to accomplish?
Please provide some examples.

4

I want to parse some JSON formatted logs. E.g:

{"url": "POST /PutData?Category=YunOsAccountOpLog&AccessKeyId=U0UjpekFQOVJW45A&Date=Fri%2C%2028%20Jun%202013%2006%3A53%3A30%20GMT&Topic=raw&Signature=pD12XYLmGxKQ%2Bmkd6x7hAgQ7b1c%3D HTTP/1.1", "ip": "10.200.98.220", "user-agent": "aliyun-sdk-java", "request": {"status": "200", "latency": "18204"}, "time": "05/May/2016:13:30:28"}

The following is the parsing method I use, but it’s always wrong:

Rule "json"
When
    True
Then
    Let json = parse_json(to_string($message.message));
  Set_fields(json);
End
5

What does that mean exactly?
What do you expect as a result and what is the actual result?

6

Expect to show in this way:
Ip
10.200.98.220

User-agent
Aliyun-sdk-java

Status
200

Latency
18204

7

And what is the actual result with your pipeline rule?

8

No processing log message.

9

Is the rule assigned to a processing pipeline?
Is the processing pipeline connected to a stream?
Does the rule work in the pipeline simulator?

10

Oh, it was my fault. I did not find change in the name of the rule. Thank you for your suggestion. It helps me very much.

11

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.