Finding grok pattern for Log files

0
votes

I have a log file of the format :

root         2  0.0  0.0      0     0 ?        S    17:28   0:00 [kthreadd]

I do not know how to read the timestamps that are separated by :.

The grok pattern I was able to implement till now is :

%{WORD:user}\s*%{NUMBER:pid}\s*%{BASE16FLOAT:cpu}\s*%{BASE16FLOAT:mem}\s*%{NUMBER:vsz}\s*%{NUMBER:rss} \?\s* %{WORD,:stat}\s*
1
elasticsearchlogstashlogstash-grok

1 Answers

0
votes

Please find below the grok pattern that matches your input log:

%{WORD:user}\s*%{BASE10NUM:pid}\s*%{BASE10NUM:cpu}\s*%{BASE10NUM:mem}\s*%{BASE10NUM:vsz}\s*%{BASE10NUM:rss} \?\s*%{WORD,:stat}\s*(?<time>([0-1]?[0-9]|2[0-3]):[0-5][0-9])\s*(?<time2>([0-1]?[0-9]|2[0-3]):[0-5][0-9])\s*\[%{DATA:username}\]

I have used the combination of Grok + Oniguruma

Oniguruma

The oniguruma syntax is the following:

(?<field_name>the pattern here)
  • field_name is the key
  • the pattern here is where you put in the regex pattern

Grok + Oniguruma

You can combine Grok and Oniguruma like the following:

%{SYNTAX:SEMANTIC} (?<field_name>the pattern here)

I have used Grok Debugger to validate the grok pattern. Also, find the output of the grok pattern below. enter image description here