Search code examples
regexlogstashlogstash-grokkibana-5

how do I escape backslash in Grok custom pattern

I have an input as

app\exceptions\SomeException

and pattern is

%{EXCEPTION_CLASS:exception}

and custom pattern as

{"EXCEPTION_CLASS" : "app\\\\exceptions\\\\SomeException"}

In Grok debugger(in Kibana), the output is as 

{
  "exception": "app\\exceptions\\SomeException"
}

This is not what I was expecting. First, using double backslash doesn't match the input. 

{"EXCEPTION_CLASS" : "app\\exceptions\\SomeException"}
#This gives no output

Second, I got output with four backslash, but there were double backslash in it which what I expected was single backslash just like the input.

How does this work and how do I properly escape backslash in Grok pattern?

Solution

  • I tried your example. Following grok works for me with this input "\app\exection\somethingother"

    grok{
    match => { "message" => "\\%{WORD:app}\\%{WORD:exception}\\%{WORD:other}" }
}

    So \ for escaping \ works fine for me.