How exactly am I to format this a-zA-Z for GROK custom regular expressions?

Question

Please see image. How the heck do you get a simple [a-zA-Z] expression to work in the KIBANA X-Pack Grok debugger? I've tried several flavors and have ran the regex just fine in normal regex testing environments where it finds all that I need but this debugger wants something that I cannot figure out. Again this is a CUSTOM regular expression not the pre-built ones.

• [a-z]
• [A-Z]
• [a-zA-Z]
• ([a-zA-Z]+)

and more

Answer 1

The first box is the data string, the second box is the pattern and the last box is where you define custom patterns. You have no pattern and the syntax for defining a custom pattern is wrong.

In the second box type

%{MY_REGEX:results}

In the third box type

MY_REGEX [a-z]

This creates a new pattern called MY_REGEX which can be used in the actual search pattern.

That matches the first character of the data, which is unlikely to be what was intended, but that should get you started.

See also https://www.elastic.co/guide/en/kibana/current/grokdebugger-getting-started.html#grokdebugger-custom-patterns