Search code examples
regexlogstashlogstash-grokregular-language

grok regex pattern matching

I want to find the grok pattern for this:

INFO: 200000 packets. Current packet is class com.navtech.kernel.flat.FlatCombo [Loader] [tstamp: 1866 time: 1851.4 (30:51) split: 03.2] [Memory: 3.320G total: 22.20G free: 18.88G]

I tried 

\A(?:%{LOGLEVEL:level})%{GREEDYDATA:message}\s(?:%{JAVACLASS:caller_class})\s+(\[%{WORD:loglevel}\]\s+)+(\[%{DATA:ts}\]\s+)+(\[%{DATA:mem}\])

but now what I'm missing is to extract the "Memory:" and "total:" so how will I write regular expression for that?

Solution

  • You may use

    ^(?:%{LOGLEVEL:level}):\s*%{DATA:message}\s*(?:%{JAVACLASS:caller_class})\s+\[%{WORD:loglevel}\]\s+(\[%{DATA:ts}\]\s+)+(\[\s*\S+\s+%{BASE10NUM:memory}\S*\s+\S+\s+%{BASE10NUM:total}.*?\])

    Where %{DATA:mem} is replaced with \s*\S+\s+%{BASE10NUM:memory}\S*\s+\S+\s+%{BASE10NUM:total}.*?:

    • \s*\S+\s+ - 0+ whitespaces, 1+ chars other than whitespace and 1+ whitespaces (we are skipping Memory:)
    • %{BASE10NUM:memory}\S* - memory value consisting of a number + zero or more non-whitespace symbols after the number
    • \s+\S+\s+ - 1+ whitespaces, 1+ chars other than whitespace and 1+ whitespaces (we are skipping total:)
    • %{BASE10NUM:total} - total value that is a number
    • .*? - any 0+ chars up to the first ]

    See the test screen:

    enter image description here