特殊字符的Logstash grok

Question

Following is my log

# Time: 2017-11-02T07:41:22.631956Z# User@Host: root[root] @ localhost []  Id:     

I am not able to write grok pattern for the word root[root] . I want this value as a single column. Example : host = root[root] .

I want [ in my value.

How to do this ?

Answer 1

%{DATA:user} should do.

You can see the definition for DATA here .

A grok filter for parsing your whole logline could look somewhat like this (I'm not really sure which parts you're interested in but you get the idea):

# Time: %{TIMESTAMP_ISO8601:timestamp}# %{DATA:user}@%{DATA:host}: %{DATA:user2} @ %{DATA:host2} \[\]  Id:

Results from https://grokconstructor.appspot.com :