Search code examples
elasticsearchlogstashlogstash-grok

Is there a way to use grok to break up a message using the character numbers?

So for instance the log I need to break apart is something like this

"01234567895467894ACCP 844" Where 0123456789 is phone number, 5467894 mandate number, ACCP is the type of mandate but for instance could be 6 long so it gets 2 spaces afterward. 844 some other number. What I need to do is separate the line based on character number. Which will always be constant.

So Something like %{CHAR 0-10:Phonenumber)%{CHAR 11-18:Mandate}%{CHAR 19-24:Type} Is there someway to do this using groks? I tried looking but did not find anything like it.

Solution

  • The following regular expression based grok expression allows you to capture what you expect:

    (?<Phonenumber>\d{10})(?<Mandate>\d{7})(?<Type>[A-Z\s]{4,})(?<Other>\d{3,})

    You'd get this:

    {
  "Phonenumber": "0123456789",
  "Mandate": "5467894",
  "Type": "ACCP  ",
  "Other": "844"
}