Search code examples
logstash-grok

Logstash grok pattern for space field

Hi How to write a grok expression for the below log 

[2017-03-25T00:00:07,137][WARN ]

match => { "message" => "\[%{TIMESTAMP_ISO8601:timestamp}/]/[%{LOGLEVEL:log-level}\s*\]" }

Is this correct , how to write space in grok ? Thanks

Solution

  • %{SPACE} is that pattern that matches 0 or more spaces, which is very useful if you don't know (or care!) if there will be a space or not.