Regex Matching in Pipeline or Extractor

Graylog Central (peer support)
16

I hate regex as much as I love Grok. Why don’t give a try with Groks?
Grokpattern needed beforehand:

DATA_ALL_BUT_SPACE 	[^ ]+
DATA_ALL_BUT_CLOSED_CORNERED_BRACKET 	[^]]+
DATA_ALL_BUT_OPENED_CORNERED_BRACKET	[^[]+

Now build a grok saved as myMagic using those to get the string done:
%{DATA_ALL_BUT_SPACE:source} Hostd: %{DATA_ALL_BUT_OPENED_CORNERED_BRACKET:host}]%{DATA_ALL_BUT_CLOSED_CORNERED_BRACKET:some_id}]

and we have those fields:

{
  "source": "herpa.derpa.corpo.lab",
  "host": "verbose hostd",
  "some_id": "2103629"
}

And not build a pipeline parsing it:

rule "parse_myMagic"
when
  //what ever reason applies
then
  set_fields(
    grok(
      pattern:"^%{myMagic}",
      value:to_string($message.message),
      only_named_captures:true
    )
  );
end

and you should be done.

2 Likes