Menu
I am new to regular expressions but I think people here may give me valuable inputs. I am using the logstash grok filter in which I can supply only regular expressions.
I have a string like this
/app/webpf04/sns882A/snsdomain/logs/access.log
I want to use a regular expression to get the sns882A part from the string, which is the substring after the third "/", how can I do that?
I am restricted to regex as grok only accepts regex. Is it possible to use regex for this?
377
With the Grok Debugger, we can copy and paste the example log line in the first “Input” field and the Grok filter in the second “Pattern” field. We should also tick the checkbox for “Named Captures Only” so that the output only displays the parts matched by our declared filter.
The regex parser uses named groups in regular expressions to extract field values from each line of text. You can use grok syntax (i.e. %{PATTERN_NAME:field_name} ) to build complex expressions taking advantage of the built-in patterns provided by Panther or by defining your own.
A grok pattern is like a regular expression that supports aliased expressions that can be reused. This processor comes packaged with many reusable patterns. If you need help building patterns to match your logs, you will find the Grok Debugger tool quite useful! The Grok Constructor is also a useful tool.
Yes you can use regular expression to get what you want via grok:
/[^/]+/[^/]+/(?<field1>[^/]+)/
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
