Cannot be parsed using grok

[tsaikd]

Cannot be parsed using grok

[wenma]

good 👍

[tengattack]

You can try this example: #80
And debug the pattern piece by piece in stdout output.

[tsaikd]

@tengattack can you help to update grok README to avoid the kind of issue?

[yequ]

😊

[tengattack]

@wang1219 The problem of your config is using a pattern NGUSER which is not pre-defined:
https://github.com/vjeantet/grok/blob/master/patterns/grok-patterns

- %{NGUSER:remote_user}
+ %{USER:remote_user}

You could change it to USER.

BTW, if you need faster grok parse speed (by using C code binding regexp library: Onigmo), you can compile gogstash from source code.

A Dockerfile example:

FROM golang:alpine

ARG version

RUN apk --update add --no-cache ca-certificates git tzdata build-base

# build onigmo
WORKDIR /src/build/
RUN git clone https://github.com/k-takata/Onigmo.git --depth=1 \
  && cd Onigmo && ./configure && make && make install

WORKDIR /go/src/github.com/tsaikd/gogstash
COPY . /go/src/github.com/tsaikd/gogstash
RUN sed -i -e 's/github.com\/vjeantet\/grok/github.com\/tengattack\/grok/' /go/src/github.com/tsaikd/gogstash/filter/grok/filtergrok.go \
  && go get -d -v ./...
RUN go build -ldflags "-X main.Version=$version"

[tengattack]

@tsaikd No problem.

[wang1219]

@tengattack Very thanks.