My Grok pattern run perfectly on Grok Debugger
Log:
2024-12-18 15:33:40.096 7f8343fff700 Connect: Connected to eventproxy.ap1.data.vmwservices.com[52.68.69.63]:443.
Grok:
Connected to %{GREEDYDATA:connect}[%{IPV4:dest_ip}]:%{WORD:port}
Output:
[
{
"connect": "eventproxy.ap1.data.vmwservices.com",
"dest_ip": "52.68.69.63",
"port": 443
}
]
However, I put the same Grok pattern to Graylog, error message:
Errors: token recognition error at: '' Undeclared variable dest_ip in line 9 pos 55 token recognition error at: '"Connected to %{GREEDYDATA:connect}[' mismatched input '<EOF>' expecting {';', '[', '.', '+', '-', '*', '/', '%', '<=', '>=', '>', '<', '==', '!=', And, Or} Expected type String for argument pattern but found Map in call to function grok in line 8 pos 34 token recognition error at: '")n);nset_fields(n fields: gl2_fragment_grok_resultsn);nend' mismatched input ']' expecting {')', '[', ',', '.', '+', '-', '*', '/', '%', '<=', '>=', '>', '<', '==', '!=', And, Or} Missing required parameter value of type String in call to function grok in line 8 pos 34 Undeclared variable port in line 9 pos 73 Unknown function message in line 10 pos 29 Incompatible types (grok(pattern: {IPV4:dest_ip})) : GrokResult <=> ({WORD:port}) : Map in line 8 pos 34 extraneous input '%' expecting {'(', '[', '{', '+', '-', Not, '$message', Boolean, Integer, Float, Char, String, Identifier} mismatched input '",n value: to_string($message."' expecting {';', '[', '.', '+', '-', '*', '/', '%', '<=', '>=', '>', '<', '==', '!=', And, Or}
“I’ve tried using ‘[‘ and “[” or similar patterns, but they do not work. Could you please help?”
Steven Tse is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.