Search code examples
elasticsearchlogstashgroklogstash-grok

Pattern failure with grok due a longer integer in a column

I have used grok debugger to get the top format working and it is being seen fine by elasticsearch. Eventually, when a log line like the one below hit it shoots out a tag with "grokparsefailure" due to the extra space before each integer (I'm assuming). Is there a tag I can use to accept anything no matter how long or short for each column? 

0000003B 2015-03-14 07:46:14.618 16117 16121

00000DA1 2015-03-14 07:45:54.609  6382  6382
Solution

  • One or more spaces between two integers:

    %{INT} +%{INT}