Two words break my grok

Graylog Add-ons
1

Hi I have the following log line and I’m trying to write a basic grok extractor

User: jsmith, Client: SSL client, ApplicationProtocol: HTTPS

When using :

User: %{WORD:User}, Client: %{WORD:Client}%{GREEDYDATA:remainder}

User comes over properly, but Client only shows “SSL” and not the second word (client) which is then shown in the remainder field. How can I populate Client with every word up to the next comma?

Thanks!

2

I fixed it! Here’s how to do it for those in the same predicament…

Client: (?<Client: >[^,]*)

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.