You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hi jordan,
I have been trying to understand discover and its functionality. I was experimenting with various regular expressions and found this. Can you please explain the below behavior of grok.discover.
I included a new pattern in my pattern file called wslog
WSLOG [%{WSDATE:timestamp}]%{SPACE}%{WORD:address}%{SPACE}%{USERNAME:user}%{SPACE}%{WORD:code}%{SPACE}%{GREEDYDATA:text}
now test input is [2/18/11 18:04:02:230 PST] 0000000a ManagerAdmin I TRAS0017I: The startup trace state is *=info.
Now when i give the input and mention the pattern explicitly as grok.match("%{WSLOG}") it works. i can see the capture. But when i give grok.discover(input) then it does not gives me wslog it gives me
[%{DATE} %{ISO8601_SECOND}:%{HOSTPORT} PST] 0000000a ManagerAdmin I TRAS0017I: The startup trace state is *=info.
it does not give me wslog. Is it because discover uses some default pattern file and not the user specified file?
my code:
#!/usr/bin/env ruby
#
require "rubygems"
require "grok-pure"
require "pp"
grok = Grok.new
grok.add_patterns_from_file("grok-patterns")
input = "[2/18/11 18:04:02:230 PST] 0000000a ManagerAdmin I TRAS0017I: The startup trace state is *=info."
pattern = grok.discover(input) # this gives me [%{DATE} %{ISO8601_SECOND}:%{HOSTPORT} PST] 0000000a ManagerAdmin I TRAS0017I: The startup trace state is *=info.
#pattern ="%{WSLOG}" #this works properly
puts "Input: #{input}"
puts "Pattern: #{pattern}"
grok.compile(pattern)
match = grok.match(input)
puts match
puts "Resulting capture:"
pp match.captures
The text was updated successfully, but these errors were encountered:
Hi jordan,
I have been trying to understand discover and its functionality. I was experimenting with various regular expressions and found this. Can you please explain the below behavior of grok.discover.
I included a new pattern in my pattern file called wslog
WSLOG [%{WSDATE:timestamp}]%{SPACE}%{WORD:address}%{SPACE}%{USERNAME:user}%{SPACE}%{WORD:code}%{SPACE}%{GREEDYDATA:text}
now test input is [2/18/11 18:04:02:230 PST] 0000000a ManagerAdmin I TRAS0017I: The startup trace state is *=info.
Now when i give the input and mention the pattern explicitly as grok.match("%{WSLOG}") it works. i can see the capture. But when i give grok.discover(input) then it does not gives me wslog it gives me
[%{DATE} %{ISO8601_SECOND}:%{HOSTPORT} PST] 0000000a ManagerAdmin I TRAS0017I: The startup trace state is *=info.
it does not give me wslog. Is it because discover uses some default pattern file and not the user specified file?
my code:
The text was updated successfully, but these errors were encountered: