Pipeline grok pattern UPPER CASE processing vars

Graylog Central (peer support)
1

i have created an pipeline rule to parse the custom apache logs

rule "apache smsat"
when
 has_field("message") 
then
  // grok the message field
  let message_field = to_string($message.message);
  let parsed_fields = grok(pattern: "%{HOSTNAME:requestdomain} %{COMBINEDAPACHELOG}", value: message_field);
  set_fields(parsed_fields);
end

but the created fields also contain the processing field names like

BASE10NUM COMBINEDAPACHELOG COMMONAPACHELOG HOUR INT IP IPV4 MINUTE MONTH MONTHDAY QUOTEDSTRING SECOND TIME USER USERNAME YEAR

what am i doing wrong or how to get rid of these

2

You have to tell the grok() function to only use named captures.

1 Like
3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.