Logstash Grok 正则表达式单独运行良好，但与其他 grok 表达式组合时不起作用

Question

My grok expression works fine when used with the matching string alone but when I use this grok expression with other grok expressions to capture other data that's also present in the log line, it doesn't match with the same matching string.

Case1: Below grok expression is working fine when running alone for the below log string and the value is captured in the field targetMessage

Log string: Tracking: sent request to msgDestination Grok expression: (?<targetMessage>^Tracking: (?:received response from|sent request to) msgDestination$)

Case2: When I try to run the expression with other some other data also present in the log string it doesn't work ie grok expression doesn't match with the same string as used above.

Log string: 2022-11-26 8:16:39,873 INFO [task.SomeTask] Tracking: sent request to msgDestination: MODULE1|SERVICE1|20220330051054|TASK1

Grok expression: %{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:loglevel} \[(?<classname>[^\]]+)\] (?<targetMessage>^Tracking: (?:received response from|sent request to) msgDestination$): %{WORD:moduleName}\|%{WORD:service}\|%{INT:requestId}\|%{WORD:taskName}

Debug tool used: https://grokdebug.herokuapp.com/

If anyone can please suggest what mistake I'm making here?

Answer 1

^ and $ anchor an expression to the start and end of a line respectively. You have both inside the targetMessage custom pattern, and that is in the middle of the line, so neither one matches. Remove both ^ and $