Search code examples
logstashlogstash-grok

Logstash grok for special character

Following is my log

# Time: 2017-11-02T07:41:22.631956Z# User@Host: root[root] @ localhost []  Id:

I am not able to write grok pattern for the word root[root]. I want this value as a single column. Example : host = root[root].

I want [ in my value.

How to do this ?

Solution

  • %{DATA:user} should do.

    You can see the definition for DATA here.

    A grok filter for parsing your whole logline could look somewhat like this (I'm not really sure which parts you're interested in but you get the idea):

    # Time: %{TIMESTAMP_ISO8601:timestamp}# %{DATA:user}@%{DATA:host}: %{DATA:user2} @ %{DATA:host2} \[\]  Id:

    Results from https://grokconstructor.appspot.com: enter image description here