Search code examples
regexlogstashlogstash-grok

how to match first regex occurrence using grok filter

my logs are in the following format my.package.name classname: my_message

I would like to cut the class perfix .

for example:

com.example.Handler doPost: request received, jim:jay foo: bar

convert to:

request received, jim:jay foo: bar

I tied this

filter {
  grok {
    match => {"message" => "^(.*):%{GREEDYDATA:request}"}
  }
}

output { stdout { codec => rubydebug  }}

but this is what I get: 

{
       "request" => " bar",
       "message" => "com.example.Handler doPost:  request  received, jim:jay foo: bar"
       ...
}

seems like grok matches by last regex occurrence.

how can I match by first : occurrence?

Solution

  • Use a reluctant .* by using .*?. A normal .* will match as much as it can while a reluctant .*? will match as little as it can.

    Fun fact: The logstash grok DATA patterns are 

    DATA .*?
GREEDYDATA .*

    So you can define your pattern as

    ^%{DATA}:%{GREEDYDATA:request}