Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Discover problem #7

Open
cmuthapp opened this issue May 6, 2014 · 0 comments
Open

Discover problem #7

cmuthapp opened this issue May 6, 2014 · 0 comments

Comments

@cmuthapp
Copy link

cmuthapp commented May 6, 2014

Hi jordan,
I have been trying to understand discover and its functionality. I was experimenting with various regular expressions and found this. Can you please explain the below behavior of grok.discover.

I included a new pattern in my pattern file called wslog
WSLOG [%{WSDATE:timestamp}]%{SPACE}%{WORD:address}%{SPACE}%{USERNAME:user}%{SPACE}%{WORD:code}%{SPACE}%{GREEDYDATA:text}

now test input is [2/18/11 18:04:02:230 PST] 0000000a ManagerAdmin I TRAS0017I: The startup trace state is *=info.

Now when i give the input and mention the pattern explicitly as grok.match("%{WSLOG}") it works. i can see the capture. But when i give grok.discover(input) then it does not gives me wslog it gives me
[%{DATE} %{ISO8601_SECOND}:%{HOSTPORT} PST] 0000000a ManagerAdmin I TRAS0017I: The startup trace state is *=info.

it does not give me wslog. Is it because discover uses some default pattern file and not the user specified file?

my code:

#!/usr/bin/env ruby
#

require "rubygems"
require "grok-pure"
require "pp"

grok = Grok.new


grok.add_patterns_from_file("grok-patterns")

input = "[2/18/11 18:04:02:230 PST] 0000000a ManagerAdmin  I   TRAS0017I: The startup trace state is *=info."
pattern = grok.discover(input) # this gives me [%{DATE} %{ISO8601_SECOND}:%{HOSTPORT} PST] 0000000a ManagerAdmin  I   TRAS0017I: The startup trace state is *=info.
#pattern ="%{WSLOG}" #this works properly
puts "Input: #{input}"
puts "Pattern: #{pattern}"
grok.compile(pattern)


match = grok.match(input)
puts match
puts "Resulting capture:"
pp match.captures

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant