How can I escape backslash in logstash grok pattern?
11,455
You escape a backslash with a backslash. \\ matches \
%{IPORHOST:remoteip} \- \- \[%{HTTPDATE:timestamp}\] %{WORD:verb} %{NOTSPACE:request} HTTP/%{NUMBER:httpversion} %{NUMBER:status} %{NUMBER:requestNum} \\"\-\\" %{QUOTEDSTRING:agent}
Also, when it comes to escaping hyphens, check out this answer.
Related videos on Youtube
02 : 49
logstash: Using the grok debugger
07 : 14
How to Extract Patterns with the Logstash Grok Filter
12 : 00
Learning Elastic Stack 6.0: Parsing and Enriching Logs Using Logstash | packtpub.com
47 : 47
Introduction to the Logstash Grok
12 : 31
05. Elastic Stack || Logstash Message Parsing with Grok Patterns
33 : 16
grok pattern made easy
17 : 20
ELK - 32. LOGSTASH : GROK ET CUSTOM PATTERN
Author by
raygo
Proud geek-nerd, papercut survivor, gifted napper, PHP ninja.
Updated on June 04, 2022Comments
-
raygo almost 2 years
This is my log:
68.192.186.96 - - [18/May/2015:12:54:42 +0000] GET http://test.com/sectionId/592/apiVersion/2/type/json HTTP/1.1 200 575 \"-\" \"Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36\" \"icon_seq=0; PHPSESSID=frmnhfrrc25ullikbv71thc283\"this is my pattern
%{IPORHOST:remoteip} \- \- \[%{HTTPDATE:timestamp}\] %{WORD:verb} %{NOTSPACE:request} HTTP/%{NUMBER:httpversion} %{NUMBER:status} %{NUMBER:requestNum} \"\-\" %{QUOTEDSTRING:agent}When I check it's giving me problems with the backslashes in the log. How can I escape them? thanks!