Search code examples
regexlogstash-grokgrok

Match everything that comes before a character, if there is one (Regex)

Good evening guys!

I wrote a pattern that catches resource:

X-ray Tracing ID : Root=%{DATA:resource}

In the log excerpt below:

(d9be2aec-d683-4d9b-8d3c-428f1f339416) X-ray Tracing ID : Root=1-612dd69a-4b2951db368113005fb367ce

However, I am considering a case when an additional fragment after @ appears in the logs, which I would not like to take into account:

(d9be2aec-d683-4d9b-8d3c-428f1f339416) X-ray Tracing ID : Root=1-612dd69a-4b2951db368113005fb367ce@12345678998765

This is where the grok works that I wrote:

X-ray Tracing ID : Root=%{DATA:resource}[^@]*

And how to combine these two cases? Similar syntax, except that if @ appears we do not take into account the rest, and if it does, and if it does not, we take all of it?

I am a beginner in grok patterns so would appreciate a tip.

Solution

  • If you check the Grok patterns, you will see DATA .*?. If your pattern ends with this construct, it won't match anything as lazy patterns at the end of regex never consume any text.

    I suggest matching all chars other than whitespace and @ here with (?<resource>[^[:space:]@]+) rather than using the DATA pattern:

    X-ray Tracing ID : Root=(?<resource>[^[:space:]@]+)

    See the test screenshot:

    enter image description here