Search code examples
regexdebugginglogstash-grokgrok

Grok testing not working for me?

I'm trying to test out something using the grok debugger and I'm not having a ton of luck.

I have the following input: 

?brandingMediaId=1

And I want to match the entire string that starts with a ? until the first space after it, so I'm using

%{\?[^\s]+:TEST}

As a custom pattern and the trying to match %{TEST:mytest} and I'm getting a compile error. I don't understand what I'm doing wrong here.

https://grokdebug.herokuapp.com/

EDIT: I'm dumb: I didn't know that %URIPARAM is a thing. I'm going to close this in a moment.

Solution

  • This matches a pattern called %{URIPARAM} which can be used like %{URIPARAM:HttpParam} or something like that.