Search code examples
elasticsearchlogstashlogstash-grok

Finding grok pattern for Log files

I have a log file of the format :

root         2  0.0  0.0      0     0 ?        S    17:28   0:00 [kthreadd]

I do not know how to read the timestamps that are separated by :.

The grok pattern I was able to implement till now is :

%{WORD:user}\s*%{NUMBER:pid}\s*%{BASE16FLOAT:cpu}\s*%{BASE16FLOAT:mem}\s*%{NUMBER:vsz}\s*%{NUMBER:rss} \?\s* %{WORD,:stat}\s*
Solution

  • Please find below the grok pattern that matches your input log:

    %{WORD:user}\s*%{BASE10NUM:pid}\s*%{BASE10NUM:cpu}\s*%{BASE10NUM:mem}\s*%{BASE10NUM:vsz}\s*%{BASE10NUM:rss} \?\s*%{WORD,:stat}\s*(?<time>([0-1]?[0-9]|2[0-3]):[0-5][0-9])\s*(?<time2>([0-1]?[0-9]|2[0-3]):[0-5][0-9])\s*\[%{DATA:username}\]

    I have used the combination of Grok + Oniguruma

    Oniguruma

    The oniguruma syntax is the following:

    (?<field_name>the pattern here)
    • field_name is the key
    • the pattern here is where you put in the regex pattern

    Grok + Oniguruma

    You can combine Grok and Oniguruma like the following:

    %{SYNTAX:SEMANTIC} (?<field_name>the pattern here)

    I have used Grok Debugger to validate the grok pattern. Also, find the output of the grok pattern below. enter image description here