Search code examples
logstashlogstash-grok

Grok parsing negative numbers into Kibana custom fields

Been banging my head against the wall over this - started out with logstash and Grok 2 days ago and made a bit of progress but i've been stuck looking at this particular problem all evening.

I have the following lines of input from a log file being ingested into logstash.

'John Pence ':'decrease':-0.01:-1.03093: 0.96: 0.97

'Dave Pound':'increase':0.04:1.04000: 0.97: 0.93

With the following grok filter matches:

match => { "message" => "%{QS:name}:%{QS:activity}:%{BASE16FLOAT:Change}:%{BASE16FLOAT:Percentage}: %{BASE16FLOAT:CurrentPrice}: %{BASE16FLOAT:PreviousPrice}" }
match => { "message" => "%{QS:Name}:%{QS:Activity}:-%{BASE16FLOAT:Change}:-%{BASE16FLOAT:Percentage}: %{BASE16FLOAT:CurrentPrice}: %{BASE16FLOAT:PreviousPrice}" }

This produces the following output in Kibana: enter image description here

As you can see - I can't get the negative numbers to display correctly, how would one correctly show the minus sign in a grok filter? Would greatly appreciate some help!

Solution

  • You can simply use the NUMBER grok pattern instead of BASE16FLOAT

    The following grok pattern works perfectly on your input:

    grok {
    "match" => {"message" => "%{QS:name}:%{QS:activity}:%{NUMBER:Change}:%{NUMBER:Percentage}: %{NUMBER:CurrentPrice}: %{NUMBER:PreviousPrice}"}
}