I am currently using Graylog v2.5.1. The log data comes from a powershell script that I wrote. I trim whitespace off of each variable before concatenating the variable data into a single string and writing it to a text file. For fun, I just checked the type of each variable in the code, and they are either System.string or System.Int32. Nothing strange
For testing purposes, I copy and paste directly from the text file into the online GROK debugger, which has no problem processing the data using the WORD or NUMBER patterns. I don’t think there are any unprintable characters
I’ve upgraded to Graylog v3.0 to see if that might help. After upgrading, I build a GROK pattern in the new tester (which is a very nice addition). I copied and pasted the test data directly from the log file, and it worked perfectly (see first image below).
I then copied and pasted my GROK expression from the tester into an extractor, and get the same error as before (see second image below)
Tried completely removing “-” and “_”, but no luck.
For my next test, I reversed the order of the fields in the incoming log text so that the number fields were first, and removed dashes and underscores. Doing so elimintes the possibility of the originating powershell script inserting unreadable characters etc. When I begin creating a GROK pattern using %{NUMBER:FirstNumber} only the first digit gets extracted (See first screenshot below). When I add a space after the NUMBER pattern in an attempt to grab the entire number, I get an error (See second screenshot below)
