Getting regex that grok filter is converted to?

Question

I have a complex grok filter expression... is it possible to get the regex that this filter is converted to?

Answer 1

You can do it with a simple Perl script that reads the patterns file and replaces the %{PATTERN} stuff with the actual regex it's based on -- you'll have to customize this a little, but it shows how to do it:

#!/usr/bin/perl

# this is the path to your grok-patterns file
open(F,"patterns/grok-patterns");
while (<F>) {
  chomp;
  if (/^(\S+) (.*)/) {
    $pattern{$1} = $2;
  }
}
close(F);

# this is the grok pattern I want to expand
$pattern='%{IP:junk} %{COMBINEDAPACHELOG:junk2}';

while ($pattern =~ /(%\{([^:\}]+):?[^\}]*\})/) {
    $name = $2;
    substr($pattern,$-[0],$+[0]) = $pattern{$name};
}
print $pattern,"\n";