[serverity]MMDD 的自定义 Grok 模式

Question

I'm a beginner in writing grok patterns and I'm unable to figure out how to write custom grok pattern for this

I0224 22:37:20.377508 2437 zookeeper_watcher.cpp:326] Zk Session Disconnected, notifying watchers

"I" being log_severity. and "0224" is in MMDD format.

I've tried to work in https://grokdebug.herokuapp.com/ with the standard grok patterns but I'm unable to seperate log_severity from month and day.

Really appreciate any help or directions.

Thanks!

Answer 1

%{DATA:severity}%{MONTHNUM:month}%{MONTHDAY:day} %{TIME:timestamp}%{SPACE}%{INT:num}%{SPACE}%{GREEDYDATA:message}

This is what I've come up with after quite a bit of researching. Hopefully it'll be useful for someone who's looking!